Installation & Administration of Konftel 800

Installation & Administration of Konftel 800

E N G L I S H

K O N F T E L . C O M

NOTICES

Konftel AB hereby declares that this conference phone is in conformity with all theessential requirements and other relevant provisions of Radio Equipment Directive2014/53/EU (RED). Please visit www.konftel.com to view the complete declarationof conformity.

WARNING:

Do not expose Konftel 800 to water or moisture.

WARNING:

Do not open the casing of Konftel 800.

2

Table of contentsChapter 1: Introduction 6Purpose.......................................................... 6Change history................................................7

Chapter 2: Overview 10Phone overview............................................ 10Deployment options...................................... 10Physical layout..............................................12Connection layout......................................... 13Icons............................................................. 14Dimensions................................................... 18Safety guidelines.......................................... 18

Chapter 3: Initial setup andconfiguration 20

Out-of-box experience.................................. 20Configuration of Konftel 800......................... 21Setting the password for Konftel 800............21DHCP configuration options......................... 22Connecting to a network with DHCP............ 23Konftel 800 .xml configuration files............... 24Modification of an .xml configuration file.......25Validation of a configuration file.................... 27Administration through the web interface..... 28Viewing the IP address................................. 29Setting a static IP address............................ 30Logging in to the web interface of

Konftel 800............................................. 30Configuring the settings through the

web interface.......................................... 31Logging out from Konftel 800........................31Administration by using the phone's

touch screen...........................................32Logging in to Konftel 800.............................. 33Configuring the settings on the phone.......... 33

Chapter 4: Settings configurationand management 35

Configuration parameters............................. 35Input validation and data type restrictions.... 95Phone settings.............................................. 96Rebooting the phone.................................... 96Configuring Daylight Saving Time

through the web interface.......................97

Daylight Saving Time state........................... 98Provision of the NTP server address............ 98Sleep mode...................................................99Media settings...............................................99Voice quality monitoring..............................100Quality estimate metrics............................. 101Configuring RTCP XR.................................102Configuration of the media port range........ 103SIP settings.................................................106SIP account registration status................... 106Caller information presentation...................107Configuring the Use Static Source Port

setting...................................................108Hostname to IP address mapping.............. 109Network settings......................................... 109LLDP Data Units......................................... 110

Chapter 5: Bluetooth and USBconnection 113

Bluetooth® connection................................113Bluetooth® Classic profiles......................... 114Pairing and connecting Bluetooth®

devices..................................................115Removing Bluetooth® pairing..................... 115Connection between paired Bluetooth®

devices..................................................116Automatic reconnection to a Bluetooth

device................................................... 116Bluetooth® radio......................................... 117Disabling Bluetooth® radio......................... 117USB only user mode................................... 118Time presentation in USB only user mode..118USB only user mode icons..........................119Volume synchronization.............................. 119USB ports configuration..............................120

Chapter 6: Firmware upgradeand downgrade 122

Firmware upgrade and downgrade.............122Exporting the configuration file................... 122Editing the configuration file........................123Importing the configuration file....................123Uploading a firmware file............................ 124

Validation and migration of configuration....125Firmware upgrade and downgrade

using a USB mass storage device....... 126Upgrading firmware using a USB mass

storage device without theadministrator password........................ 127

Upgrading the firmware using a USBmass storage device with theadministrator password........................ 128

Configuration retention after downgrade.... 129Device Management...................................129Registration with the ZTI device

management service............................ 131Upgrading multiple devices.........................131Configuring multiple devices.......................132

Chapter 7: Security and protection 134Security methods and protocols ................ 134Certificates..................................................135Certificate configuration file structure......... 136Certificates application................................139Standard encryption algorithms.................. 142Standard encryption for 802.1x...................143Standard encryption for media

encryption with SRTP...........................144Legacy encryption mode.............................144FIPS mode..................................................145FIPS mode for media encryption with

SRTP....................................................145SCEP support............................................. 146Auto-renewal...............................................147Configuring SCEP renewal request............ 147Provisioning of the CA certificate

through SCEP...................................... 148Web interface settings................................ 148Disabling web access................................. 149Protection against cross-site request

forgery.................................................. 150

Chapter 8: Calls handlingapplication 151

Konftel Unite............................................... 151Pairing and connecting devices.................. 151Disconnecting devices................................ 152Deleting pairing...........................................153Configuring the Konftel Unite settings........ 153Konftel Unite settings..................................154

Chapter 9: Coverage expansion 156Expansion of the phone coverage.............. 156Physical layout............................................156Smart Mic characteristics............................157Expansion coverage arrangement..............158Functions of the Main and Expansion

devices................................................. 158Connection of the Expansion devices to

the Main phone.....................................159Arranging a daisy chain.............................. 159Defining the mode of the phone..................160Disabling Daisy Chain mode.......................161Expansion microphone firmware upgrade.. 161Upgrading expansion microphone

firmware................................................162Upgrading two expansion microphones......163Terminating expansion microphone

upgrade................................................ 164Upgrading Smart Expansion

Microphone manually........................... 165

Chapter 10: Maintenance 166System recovery......................................... 166Performing system recovery....................... 166Remote syslog server................................. 167Configuring remote syslog settings.............167Fall back server support............................. 168Factory reset...............................................168Performing factory reset............................. 168Device status view...................................... 169Device status.............................................. 169Viewing the phone status............................170System logs................................................ 171Viewing system logs................................... 171PJSIP log levels..........................................172Setting PJSIP log level through the web

interface................................................172Setting PJSIP log level using the

configuration file................................... 173Network logs............................................... 174Viewing network logs.................................. 174Licenses......................................................174

Chapter 11: Specifications 175Specifications..............................................175

Contents

Chapter 12: Appendix A.Encryption methods inLegacy encryption mode 177

Encryption methods in Legacyencryption mode...................................177

Index 181

Contents

INTRODUCTION

PURPOSEThis document provides checklists and procedures for installing, configuring, andadministering Konftel 800. It is intended primarily for implementation engineersand administrators.

6

CHANGE HISTORY

Issue Date Summary of changes

Release1.0.7

March 2022 • Updated Phone overview on page 10 withinformation about the connection to other devices.

• Updated Icons on page 14 with the Volume Officon.

• Added Deployment options on page 10.• Added Out-of-box experience on page 20.• Added DHCP configuration options on page 22.• Updated Configuration parameters on page 35

with new parameters.• Added new section Configuration of the media port

range on page 103.• Added Configuring the Use Static Source Port

setting on page 108.• Added Hostname to IP address mapping on

page 109.• Updated Bluetooth® Classic profiles on page 114

with information about the LEDs behavior duringA2DP streaming.

• Added Automatic reconnection to a Bluetoothdevice on page 116.

• Added new section Volume synchronization onpage 119.

• Added new section USB ports configuration onpage 120.

• Added Configuration retention after downgrade onpage 129.

• Added Provisioning of the CA certificate throughSCEP on page 148.

• Added Disabling web access on page 149.

Table continued…

INTRODUCTION

7


Release1.0.6

September2021

• Updated Icons on page 14 with the Warning icon.• Added new section Rebooting the phone on

page 96.• Added Input validation and data type restrictions on

page 95.• Added new section SIP account registration

status on page 106.• Updated Configuration parameters on page 35

with new parameters.• Added new section SCEP support on page 146.

Release1.0.5

June 2021 • Updated Icons on page 14 with the Clear callhistory button.

• Updated Standard encryption algorithms onpage 142 with the information about FIPS mode.

• Updated Legacy encryption mode on page 144 withthe information about firmware upgrade.

• Added new section FIPS mode on page 145.• Added new section USB only user mode on

page 118.• Updated Expansion of the phone coverage on

page 156 with the information about disabling theunused daisy chain ports during active calls.

• Updated Bluetooth® connection on page 113 withthe information about USB only user mode.

• Added new section Firmware upgrade anddowngrade using a USB mass storage device onpage 126.

• Updated Configuration parameters on page 35with new parameters.

• Added new section Protection against cross-siterequest forgery on page 150.

• Added Appendix A with the information about thelist of encryption methods enabled and disabled inLegacy encryption mode.

Table continued…

INTRODUCTION

8


Release1.0.4

February2021

• Added Provision of the NTP server address onpage 98.

• Updated Voice quality monitoring on page 100 withthe quality estimate metrics and analogparameters.

• Added Standard encryption algorithms onpage 142.

• Updated Konftel Unite on page 151 in line with thechange in MD5 usage.

• Added Expansion microphone firmware upgrade onpage 161.

• Updated Bluetooth® connection on page 113 withinformation on switching between the Bluetoothmodes.

• Updated Configuration parameters on page 35with new parameters.

Release1.0.3

October2020

• Added Bluetooth® radio on page 117.• Updated Configuration parameters on page 35

with new parameters.• Updated Certificates on page 135 with the

information about the paths to the certificates, MD5checksum, and certificate configuration filestructure.

Release1.0.2

August2020

• Added Sleep mode on page 99.• Added Voice quality monitoring on page 100.• Added Bluetooth® connection on page 113.• Updated Configuration parameters on page 35

with new parameters.

Release1.0.1

March 2020 • Added Firmware upgrade and downgrade onpage 122.

• Added Validation and migration of configuration onpage 125.

• Added Upgrading multiple devices on page 131.• Added Remote syslog server on page 167.

INTRODUCTION

9

OVERVIEW

PHONE OVERVIEWKonftel 800 is a SIP conference phone that you can use to make calls and holdconferences with great audio quality. It improves user experience and ensures aneasier connection to audio conference bridges.

The conference phone features include a simple-to-use 4.3 inch graphical LCDwith a backlight, volume control, and mute buttons. Two more mute key buttonsare located along the perimeter of the device. There are 3 microphones in thebase of Konftel 800, which support 10 users in a 30 square meters room. You canattach additional expansion microphones to increase the conference phonecoverage to 70 square meters or daisy chain three Konftel 800 devices to cover upto 90 square meters.

Konftel 800 can act as an Audio Media Device connected to a personal computeror a laptop via USB and activated through soft client software. The conferencephone can also use Bluetooth to connect to a mobile device, a personal computer,or a laptop as it supports Hands-Free and A2DP Bluetooth profiles.

Konftel 800 uses 10/100 Mbit Ethernet and supports PoE Class 1 and Class 2power.

DEPLOYMENT OPTIONSKonftel 800 provides several deployment options to match the scope andcomplexity of your operating environment.

USB or Bluetooth media device

You can use your Konftel 800 as a USB or Bluetooth media device with a personalcomputer, a laptop, a video conference system, and many other devices. Thephone has a USB connector and ensures Bluetooth connection.

Konftel 800 receives power through the Ethernet power injector (there is nopower supply via USB supported).

SIP Endpoint

Konftel 800 can function as a SIP device. For this deployment option, you musthave the IP network engineered to support the excellent voice qualitytransmission. You must configure IPv4 via DHCP or manual configuration andspecify its IP address, network mask, and gateway.

10

Konftel 800 functions as a SIP device when your communication system has SIPaccounts provisioned with the following minimum parameters available:

• SIP registrar address (IP address or a fully qualified domain name (FQDN))• SIP registrar protocol (UDP, TCP, or TLS) and SIP registrar port• SIP account name• SIP account password

To enable additional features, including more complex security options, you mayrequire to have other parameters configured.

Individual device management

If you deploy a small number of devices and do not plan to establish a centralizedmanagement HTTP server, you can access the configuration of Konftel 800through the web interface or using the phone user interface.

Configure the parameters through the web interface as it allows convenientlogging, easy data input and enhanced status information.

Centralized device management

If you deploy multiple Konftel 800 devices, to simplify their configuration, use acentralized server that provides software, generic and MAC-specific configurationand certificate files. You must specify the IP address or FQDN of the HTTP/HTTPS file server manually or through DHCP.

When the phone checks the file server, it compares its running firmware and theone available on the file server and performs an upgrade or downgrade if theversions are different. You can automate the configuration update process. Konftel800 can poll the file server at a defined interval for changes and apply the changeswhen in Idle mode.

Related conceptsDHCP configuration options on page 22Bluetooth® connection on page 113USB only user mode on page 118

OVERVIEW

11

PHYSICAL LAYOUT

Figure 1: Front view of Konftel 800

The following table lists the buttons and the other elements of Konftel 800.

Callout number Description

1 Mute buttons

2 Volume down button

OVERVIEW

12


3 Volume up button

4 NFC tag

5 Touch screen

6 LED status indicators

CONNECTION LAYOUT

Figure 2: Connection layout of Konftel 800

The following table lists the sockets and ports available on Konftel 800 forconnection.

OVERVIEW

13


1 PoE/Ethernet connection socket

2 USB Type A

3 Micro-USB Type B

4 Audio expansion ports

5 Kensington® security lock port

6 NFC tag for Bluetooth

ICONSIcons on the home screen of Konftel 800

Icon Name Description

Recent To check the call list. The phone provides the followinginformation about the calls:

• Number. View the phone number of the contact.• Date. View the information when the phone received

the call. This applies only to the calls preceding thecurrent day.

• Time. For the current day, the phone shows the timeof the call in the convenient time format.

• Direction. View the incoming, outgoing and missedcalls.

Unite To access the Konftel Unite settings.

Call To dial phone numbers and codes for telephoneoperations or Konftel Unite connection.

OVERVIEW

14


Settings To check and configure the settings from the phone.View the phone status and reach the menu.

Warning To notify that the SIP account registration failed. Whenyou tap the Warning icon, the phone shows thefollowing pop-up message: No sip serviceregistered (Wrong username/password orregistrar?).

MicrophoneMuted

To mute and unmute the phone.

Volume Up To increase the phone volume level.

Volume Down To decrease the phone volume level.

Volume Off To provide a phone screen indication that the volume onthe phone is off when you change the volume to thelowest level on the connected USB host.

NFC To indicate the built-in NFC tag.

Other icons of Konftel 800


Make Call orAnswer

To indicate the phone off-hook status and answer anincoming call.

Hang Up To indicate the phone on-hook status and end a call.

Incoming To show an incoming call.

OVERVIEW

15


Outgoing To show an outgoing call.

Missed To indicate a missed call.

Hold or OnHold

To put a call on hold or to indicate that a call is on hold.

Conference To arrange a conference call.

Split To split a conference call into several separate calls.

AddParticipant

To add a participant to a conference call.

Talk Private To arrange a private discussion with a participant of aconference call.

Caps To type in capital letters.

Delete To delete an unneeded number or letter.

Visibility To mark whether the characters must stay visible to theuser, for example, when logging in with the password.

Invisibility To mark whether the characters must stay invisible tothe user, for example, when logging in with thepassword.

Logged In To indicate that the user logged in as the administrator.

OVERVIEW

16


MicrophoneMuted

To indicate that the phone is in muted state.

Enter To confirm the input of information.

Confirm To confirm the information.

Reject To discard the information.

Arrow Down To move to the sections below.

Arrow Up To move to the sections above.

Arrow Left To return to the previous page.

Arrow Right To move to subsections of a section.

USBConnected

To indicate an active USB connection.

Konftel Uniteconnected

To show the connection of the phone to Konftel Unite.

Daisy ChainMode

To indicate that the phone is in a daisy chain mode.

Loading To show that the phone is loading the new version ofthe firmware.

OVERVIEW

17


Contacts To show that the LDAP external phone book isavailable.

Bluetoothconnection

To indicate an active Bluetooth® Classic connection.

Call Transfer To show that it is possible to transfer an ongoing call toanother contact person.

Clear callhistory

To clear all the call history in the call list.

DIMENSIONSThe following table shows the dimensions of Konftel 800.

Parameter Dimension

Width 326.41 mm

Length 369.87 mm

Height 74.7 mm

SAFETY GUIDELINESEnsure that you are familiar with the following safety guidelines before using,installing, configuring, and administering Konftel 800.

• Read, understand, and follow all the instructions.• Do not drop, knock, or shake the device. Rough handling can break internal

circuit boards.• Ensure that the power cord or plug is not damaged.• Do not overload wall outlets and extension cords as this can result in the risk

of fire or electric shock.• Avoid wetting the device to prevent fire or electrical shock hazard.

OVERVIEW

18

• Unplug the device from the wall outlet before cleaning. Do not use liquid oraerosol cleaners, harsh chemicals, cleaning solvents, or strong detergents toclean the device. Use a damp cloth for cleaning.

• Avoid exposing the device to high temperatures above 40°C (104°F), lowtemperatures below 0°C (32°F), or high humidity.

• Do not block or cover slots and openings of the device. These openings areprovided for ventilation, to protect the phone from overheating.

• Never push objects of any kind into this device through cabinet slots as theymight touch dangerous voltage points or short out parts that could result in arisk of fire or electric shock.

• Do not disassemble this product to reduce the risk of electric shock. Openingor removing covers may expose you to dangerous voltages or other risks.Incorrect reassembly can cause electric shock during subsequent use.

• Do not use the device to report a gas leak in the vicinity of the leak.• Do not use the device near intensive care medical equipment or close to

persons with pacemakers.• Do not place the device too close to electrical equipment such as answering

machines, TV sets, radios, computers, and microwave ovens to avoidinterference.

In case Konftel 800 and the corresponding accessories are damaged, thedevice does not operate normally or exhibits a distinct change in performance,refer for servicing to the qualified service personnel.

OVERVIEW

19

INITIAL SETUP AND CONFIGURATION

OUT-OF-BOX EXPERIENCEWhen you power Konftel 800 and connect it to a routable Ethernet connection forthe first time, the phone conducts the following actions:

• Internal self-tests: Konftel 800 confirms the hardware status and firmwaresanity.

• DHCP Discovery: the phone attempts to obtain the basic IP parameters as wellas the HTTP server, TLS server, HTTP Directory, and VLAN ID parameters,which can be in the enabled or disabled state.

• LLDP Negotiation: the phone communicates the default LLDP parameters andparses any LLDP parameters provided by the L2/L3 network device to whichKonftel 800 connects via Ethernet.

If Konftel 800 receives a VLAN ID via DHCP or LLDP, the phone releases thereceived IP address and performs DHCP Discovery with all packets tagged withthe VLAN ID. Konftel 800 only accepts ingress packets tagged with the VLAN ID.

After the phone obtains the IP address and a routable path or VLAN, it tries toreach the Network Time Protocol server to set the correct time. This attempt mayrequire the device to query the DNS for the following default server address:0.pool.ntp.org.

When Konftel 800 has the provisioning or Device Management server IP addressor Fully Qualified Domain Name (FQDN) provided via DHCP, it attempts toestablish a connection and request the following files from the server:

• Generic global certificate file kt800_certcfg.xml.• Device-specific certificate file kt800_certcfg-<MAC>.xml.

If a certificate file is obtained, the phone uses the paths from certcfg.xml todownload the list of files specified therein.

• Generic configuration file kt800.xml. If the device fails to find it with .xml fileending, it searches the configuration file with the following fileendings: .cgi, .php, .asp, .enc, .js, or .jsp.

• Device-specific configuration file kt800-<MAC>.xml. If the device fails to findit with .xml file ending, it searches the configuration file with the following fileendings: .cgi, .php, .asp, .enc, .js, or .jsp.

Konftel 800 compares these configuration files with the maximum version ofthe configuration file acceptable on the device. If the file from the HTTP serverhas a lower or equal value, the device reads, parses, and prepares to apply it.

20

If this file has a higher value, the phone ignores it as it may contain unknownor changed parameter formats.

For example, <KT800 version="7"> on the top of the 1.0.7 firmwarecompliant .xml file for the device with 1.0.6 firmware installed indicates that thefile received has a higher value than the file available on the device. Konftel800 rejects such a file.

The phone stores the configuration in its non-volatile memory.• Generic firmware version file kt800_fw_version.xml. The device also

compares this file with the current running firmware. If there is a difference,Konftel 800 requests the firmware identified in the kt800_fw_version.xmlfile from the HTTP server.

After upgrade or downgrade, the phone reboots and repeats all the describedactions. If there are no changes in the content of the various .xml files, the deviceignores them and applies the configuration stored in its non-volatile memory.

If the device does not obtain an IP address and the configuration file does notspecify an administrator password, Konftel 800 prompts you to set theadministrator password. You need this password to access the phone adminmenu and the web-based admin menu using an Internet browser.

Related conceptsFirmware upgrade and downgrade on page 122Related informationConfiguration parameters on page 35

CONFIGURATION OF KONFTEL 800Konftel 800 can use the following methods to obtain the required configurationparameters:

• Centralized HTTP/HTTPS server.• Konftel 800 web interface when you log in as the administrator.• Konftel 800 phone interface.

Setting the password for Konftel 800About this task

Use this procedure to set your Konftel 800 password when you first activate thephone or after a reset to the factory settings. By default, the administratorpassword is not set.


21

You must enter the correct administrator password to change the phoneconfiguration. For that, always remember your password. If you forget thepassword, you can perform manual device recovery.

Before you begin

Connect the PoE cable to ensure the phone power supply.

Procedure

Wait for the following message to appear on the phone screen:

For full functionality, please set administration password.Tap Yes to set the password.Optional: Tap Skip to avoid setting the password.

Here, Konftel 800 functions in the administration mode, and you can configurephone settings. However, you cannot access the web interface.Using the keyboard on the phone screen, type your password. It can containletters, numbers, and special characters.

The password must contain at least 4 characters. As you enter the password,the phone indicates if the password has an acceptable length.Type the password again to confirm it.Tap the Arrow Left icon three times to return to the home screen.

The phone reboots.

Related conceptsFactory reset on page 168System recovery on page 166

DHCP configuration optionsYou can configure Konftel 800 to automatically obtain critical configurationparameters from a DHCP server. You can use a DHCP Site Specific OptionNumber (SSON) to provide specific information for the Konftel 800 configuration.The following values are available: 43, 56, 60, 61, 66, 67, and 242. By default, theSSON value is 242. By default, the device scans all the SSON numbers to detectthe availability of the parameters below.

Konftel 800 uses values of the following parameters from the DHCP optionspecified by SSON:

• HTTPSRVR• TLSSRVR• HTTPDIR


22

• L2QVLAN

DHCP Site Specific Option Number parameters

The following table describes the parameters that DHCP SSON contains:

Parameter Description

HTTPSRVR The IP Address or FQDN of an HTTP file server, whichthe device uses to obtain configuration, firmware, orcertificates.

TLSSRVR The IP Address or FQDN of a file server, which thedevice uses to obtain configuration, firmware, orcertificates using the Transport Layer Security (TLS)protocol as the security protocol.

HTTPDIR The path name to prepend to all file names that thedevice uses in HTTP and HTTPS GET operations duringits start-up. The path is relative to the root of the TLS orHTTP file server.

The path length is from 0 to 127 ASCII characters withoutspaces.

L2QVLAN The VLAN ID of the voice Virtual Local Area Network(VLAN). The default value is 0 which means “untagged”.

The following is an example of the syntax of the DHCP SSON Option as providedwithin a DHCP Offer:L2QVLAN=114,HTTPSRVR=111.222.232.234,HTTPDIR=KT800,DES_STAT=0.

Connecting to a network with DHCPAbout this task

Use this procedure to connect to a network with DHCP from your phone orthrough the web interface.

Procedure

• To connect to the network with DHCP from Konftel 800, do the following:Log in as the administrator.Tap Network.


23

Enable DHCP.Tap the Arrow Left icon twice to return to the home screen.

The phone reboots.• To connect to the network with DHCP through the web interface, do the

following:On the web interface, click Network.Enable DHCP.Click Save.

The phone reboots.

Konftel 800 .xml configuration filesKonftel 800 uses .xml files through the centralized management server duringprovisioning. Sample .xml configuration files are available at www.konftel.com.

The following table lists the available .xml configuration files:

.xml file Description

kt800_certcfg.xml This is the first file that Konftel 800 requests. Thephone obtains 802.1X, SIP, provisioning server,and LDAP certificates from this file.

kt800_certcfg-<MAC>.xml This is the second file that Konftel 800 requests.Here, <MAC> is the MAC address of the specificphone. Ensure that the input MAC addresscontains only letters and numbers and no colons.This file replaces the default 802.1X, SIP,provisioning server, and LDAP certificates withdevice-specific certificates.

kt800.xml A global configuration file that contains the basicconfiguration.

kt800-<MAC>.xml A configuration file where <MAC> is the MACaddress of the specific phone. Ensure that theinput MAC address contains only letters andnumbers and no colons. Parameters available inthis device-specific file override the defaultconfiguration file settings.

Table continued…


24

.xml file Description

kt800_fw_version.xml A file that contains details about the firmwareversion of the phone. This file comes with eachKonftel 800 firmware build download.

Do not modify this file.

Related conceptsDevice Management on page 129Related informationConfiguration parameters on page 35

Modification of an .xml configuration fileYou can open and edit a .xml configuration file using an application to import andexport XML files. You can also choose the editor that can read .xsd files to verifythe syntax and content of the modified .xml file. You can use such software asNotepad++, Coda, TextWrangler, or any other that you find suitable.

The following screenshot is an example of a .xml configuration file in the Notepad++ editor:


25

When you open a default Konftel 800 configuration file, the second line, <KT800version="6">, indicates the firmware version. This number automaticallyincreases when the Konftel 800 firmware version is upgraded.

Do not modify the version number.

In the configuration file, the "-" icons indicate the beginning of a branch. When youclick this icon, the branch collapses. Clicking the "-" icon does not delete thebranch. To expand the branch back to the original view, click the "+" icon.

The name of the example configuration file is kt800_default_config.xml. Todeploy this configuration file through a centralized management server, changethe file name to kt800.xml or kt800-<MAC>.xml. If you upload the file throughthe web interface, you can use any file name.

You can modify the .xml file to configure the parameters of your Konftel 800. Here,add specific data to the file section. In the example you can see the expanded SIPPrimary account section with the parameters set:


26

Here, the specified parameters are the following:

SIP Domain: acmewidget.comSIP Registrar: sip.acmewidget.com using UDP on port 5060Outbound Proxy: no outbound proxySIP User: [email protected] User Authentication Name: 123456SIP User Password: 654321Keep Alive: 300 second timer enabled

Validation of a configuration fileThe release-specific firmware contains a .xsd file for the configuration file reviewfor errors in the parameters set. Konftel 800 performs a .xsd file validation when aconfiguration file is uploaded through the web interface or a management server. Ifthe validation fails, the device rejects the complete configuration file.


27

http://acmewidget.com

You can also use the editor to validate the configuration file. For example, inNotepad++, install the XMLTools plugin in the Plugin Manager and validatethe .xsd file.

Administration through the web interfaceYou can access the Konftel 800 administration pages by using the HTTPS webinterface from your laptop, PC, or tablet.

Use the Google Chrome browser to optimize the Konftel 800 web pages.

The prerequisite steps for logging in to the web administration pages are thefollowing:

You must obtain the IP address of Konftel 800 by using the phone's touchscreen. You can use a dynamic or a static IP address to connect to thenetwork.You must configure the administrator password by using the .xml configurationfile or the phone's touch screen. By default, there is no password for webadministration set.

Ensure that Konftel 800 is in Idle mode, that is it shows the normal idle screen,before attempting to log in to the web administration server. It is not possible tobe in the configuration menu on the phone and through the web interface atthe same time.

The web administration portal contains the following pages:

• Status• Phone• Network• Media• LDAP• SIP• Provisioning• System Logs• Network Logs• Licenses• Logout

You can open the required page by clicking the corresponding tab in theNavigation pane on the top.

The web administration server launches on the Status page. If you log in to theweb interface when the conference phone is still booting and establishing


28

connectivity, this page may require updating. You can update it by pressing F5 onyour keyboard.

When you make a configuration change on a page, click Save in the bottom rightto save the configuration to the non-volatile memory. To apply the change, Konftel800 may restart a specific software layer or reboot. If the device reboots, you mustwait until the procedure completion, press F5 to refresh the web page, and log inagain.

Configuration import and export

When you finalize the conference phone configuration, Konftel 800 reliableoperates in the required environment, you can save a copy of this configuration onthe Provisioning tab. Here, the device exports a copy of the non-volatileconfiguration capturing the non-default parameters and forms an .xmlconfiguration file. Whenever you decide to restore the configuration parameters,import this file, and save the configuration. Then the device reads and attempts toparse the configuration file. If there is an error in the configuration file, or the webapplication cannot parse the file, Konftel 800 shows a corresponding errormessage.

The device does not export passwords in the configuration file.

Related conceptsFirmware upgrade and downgrade on page 122Related informationConfiguration parameters on page 35

Viewing the IP addressAbout this task

Use this procedure to view the IP address of your Konftel 800.

Procedure

On the phone screen, tap Settings > Admin Login.Enter the administrator password.Tap Status or the Arrow Right icon.

The phone displays the following hardware details:

• IP Address• MAC Address• Bluetooth MAC Address• Hardware Revision• Software Version


29

• Smart Mic 1 Version• Smart Mic 2 VersionTap the Arrow Left icon twice to return to the home screen.

Setting a static IP addressAbout this task

Use this procedure to connect to the network using a static IP address, and notwith DHCP.

Before you begin

Disable DHCP.

Obtain the IP address, netmask, gateway, DNS 1, and DNS 2.

Procedure

• To set the static IP address from the phone, do the following:Log in as the administrator and tap Network. If the administrator passwordis not set for the phone, on the phone screen, tap Settings > Network.Tap Static IP, and enter the following:

• IP address• Netmask• GatewayReturn to the home screen to save the changes.

• To set the static IP address through the web interface, do the following:On the web interface, click Network.In the Static IP section, enter the following:

• IP address• Network mask• GatewayClick Save.

The phone reboots.

Logging in to the web interface of Konftel 800About this task

Use this procedure to log in to the web interface of your Konftel 800. You canaccess the web interface only if you set the administrator password for yourphone.


30

After five incorrect login attempts, the web interface becomes blocked for 15minutes. The web interface shows the following message: Login has beensuspended for 15 minutes due to too many invalid passwordentries. If you enter the invalid password less than five times, then you haveanother five attempts after five minutes break.

Konftel 800 officially supports only the Google Chrome browser.

The phone supports only HTTPS communication protocol.

Before you begin

Obtain the IP address and the administrator password for the phone.

Procedure

On the web browser, type the IP address of your phone in the following format:

https://111.222.33.44/.Enter the password in the Password field.

The password is the administrator password for your phone.Click Login to log in to the webserver of your Konftel 800.

Configuring the settings through the web interfaceAbout this task

Use this procedure to configure the settings through the web interface of yourKonftel 800.

Procedure

Log in to the web interface.On the Navigation pane, click the required tab.Choose the parameter that you want to configure and proceed to the optionsavailable.Click Save.

Logging out from Konftel 800About this task

Use this procedure to log out from the web server of your Konftel 800 from yourweb browser.


31

Before you begin

You must be logged in to the web interface of your conference phone.

Procedure

On the web browser, click Logout.

You are forwarded to the Login page and see the prompt that you are not loggedin.

Administration by using the phone's touch screenKonftel 800 allows for configuration by using its touch screen once the user logs inwith the administration password. When you modify a parameter, the deviceverifies its syntax and then automatically saves it to the non-volatile memory. Afteryou exit the menu levels to the idle screen, the conference phone restarts orreboots as required to apply the configuration.

The Settings menu that you can access from your Konftel 800 is as follows:

Settings

StatusPhoneName, Language, Security, Admin Password, Ring Level, Key Tone, DaisyChain, Startup Sound, Factory ResetMediaSRTP, SRTCP, Codec, Capability Negotiation, Voice Quality MonAdvancedFirst Media Port, Last Media PortSIPPrimary Acct, Secondary Acct, Fallback Acct, Port, Transport Protocol, TLS,DTMF, NAT TraversalAdvancedDisable 'rport', Session Timers, Session Expiration, Outbound Proxy, AllowContact Rewrite, Enable SIP Replaces, Use Static Source PortNetworkDHCP, Hostname, Domain, Static IP, DNS1, DNS2, VLAN, VLAN ID802.1x802.1x Enable/Disable, Auth Name, EAP MD5, EAP MD5 Password, EAP TLSEnable/Disable, Private Key PasswordTimeEnable NTP, NTP ServerDevice Management


32

Enable, Provisioning Server, Check Server Certification, Lowest TLS Version,DHCP Option, DES ProvisioningConference AssistantDisconnect Device, Remove Bonding InformationBluetoothPair Device, Disconnect Device, Remove Pairing

You must enter the admin password to configure most of the device's settings.

Related conceptsPhone settings on page 96Media settings on page 99SIP settings on page 106Network settings on page 109Bluetooth® connection on page 113Konftel Unite on page 151Related informationConfiguration parameters on page 35

Logging in to Konftel 800About this task

Use this procedure to log in as the administrator by using the touch screen of yourKonftel 800.

Procedure

On the touch screen, type Settings > Admin Login.Enter the administration password.

Configuring the settings on the phoneAbout this task

Use this procedure to configure the settings of your Konftel 800 on the phone.

Before you begin

Log in as the administrator.

Procedure

In the Settings menu, tap the required Settings group.Choose the parameter that you want to configure and proceed to the optionsavailable.


33

Tap the Arrow Left icon twice to return to the home screen.

The phone reboots to apply the changes.


34

SETTINGS CONFIGURATION ANDMANAGEMENT

CONFIGURATION PARAMETERSThe following table contains all configurable parameters in the order of the defaultconfiguration file. You can see the XML variable name definition for eachparameter in the left column. The right column shows a brief description of theparameter and provides the title in the web administration and the Konftel 800User Interface (the touch screen administration menus).

String Description

<KT version = "x"> Here x is the version number of the .xmlparameters list.

Do not modify.

<time> The top line of the time management section.

<time_format> To specify the time format for the phone as follows:

• hh:mm - Konftel 800 shows time using the 24-hour clock approach.

• hh:mm AP - Konftel 800 shows time using the12-hour clock approach.

• Empty value - Konftel 800 shows the standardtime format for the selected language.

Terminology reference

Web interface: Time FormatPhone UI: Not configurable

Table continued…

35

String Description

<timezone> To specify the Region/City location in line with thedefinitions from the common Timezone databases.For more information, see https://en.wikipedia.org/wiki/List_of_tz_database_time_zones. If you set thestring value to the name of a time zone, forexample, to Europe/Amsterdam, it automaticallyenables the Geo Timezone (auto DST) parameter.


Web interface: TimezonePhone UI: Not configurable

<ntp> The top line of the NTP configuration section.

<server> To specify the IP address or FQDN of an NTPserver. If DHCP Option 42 provides the NTP servervalue, Konftel 800 uses the DHCP provided value.If DHCP Option 42 is not available, the phoneapplies this XML parameter.


Web interface: NTP ServerPhone UI: NTP Server

<enable> To specify whether NTP is enabled. The options arethe following:

• True. This is the default setting.• False.


Web interface: NTP EnablePhone UI: Enable NTP

Table continued…

SETTINGS CONFIGURATION AND MANAGEMENT

36

https://en.wikipedia.org/wiki/List_of_tz_database_time_zones

https://en.wikipedia.org/wiki/List_of_tz_database_time_zones

String Description

<date_format> To specify the date format which consists of theday, month and year. Here, dd indicates the day ofthe month, D is a shortened version of the day ofweek, DD is the full version of the day of the week,M is a shortened version of the month, MM is the fullversion of the month, yy is the last 2 digits of thecalendar year, yyyy is the full calendar year.

The following date format options are available:

• dd M, D - Date, short name for the month andday of the week. For example, 10 Jan, Mon.

• dd MM, DD - Date, full name for the month andday of the week. For example, 10 January,Monday.

• M dd, D - Short name for the month, date, andshort name for the day of the week. Forexample, Jan 10, Mon.

• MM dd, DD - Full name for the month, date,and full name for the day of the week. Forexample, January 10, Monday.

• D, dd M - Short name for the day of the week,date, and short name for the month. Forexample, Mon, 10 Jan.

• DD, MM dd - Full name for the day of the week,full name for the month, and date. For example,Monday, January 10.

• dd/mm/yy - Date/month/short numericaldesignation of the year. For example, 10/01/20.

• dd/mm/yyyy - Date/month/full numericaldesignation of the year. For example,10/01/2020.

• mm/dd/yy - Month/date/short numericaldesignation of the year. For example, 01/10/20.

Table continued…


37

String Description

• mm/dd/yyyy - Month/date/full numericaldesignation of the year. For example,01/10/2020.

• yy/mm/dd - Short numerical designation of theyear/month/date. For example, 20/01/10.

• yyyy/mm/dd - Full numerical designation of theyear/month/date. For example, 2020/01/10.

• The default value. Here, your Konftel 800applies the date format that is standard for theselected language. For example, if you chooseFinnish, the date format is dd.mm.yyyy.


Web interface: Date FormatPhone UI: Not configurable

<custom_dst> The top line of the DST section.

<enable> To specify whether the Daylight Saving Time (DST)configuration is enabled. The options are thefollowing:

• True.• False. This is the default setting.

The phone ignores the Custom DST parameter ifyou configure the Timezone parameter, and theNTP server provides it. Thus, you must disable GeoTimezone (auto DST) to enable Custom DST.


Web interface: Custom DSTPhone UI: Not configurable

Table continued…


38

String Description

<offset_hours> To specify the DST hours offset. The options arethe following:

• 1. This is the default setting.• 2.


Web interface: Offset HoursPhone UI: Not configurable

<dst_start> The top line of DST start date and time section. Toindicate when the DST parameters becomeapplicable.

<month> To specify the month to apply the DST parameters.

Month number as an integer with the values of 1 to12.


Web interface: Start MonthPhone UI: Not configurable

<day> To specify the day to apply the DST parameters.

Day number as an integer with the values of 1 to31.


Web interface: Start DayPhone UI: Not configurable

<day_mode> To specify the advance or delay to apply the DSTparameters. The value range is from -5 to 5.


Web interface: Start Day ModePhone UI: Not configurable

Table continued…


39

String Description

<hour> To specify the hour to apply the DST parameters.

The hour format is a 24-hour format with valuesfrom 0 to 23.


Web interface: Start HourPhone UI: Not configurable

<dst_stop> The top line of DST stop date and time section. Toindicate when the DST parameters becomeinapplicable.

<month> To specify the month to end the DST parametersapplication.

Month number as an integer with the values of 1 to12.


Web interface: Stop MonthPhone UI: Not configurable

<day> To specify the day to end the DST parametersapplication.

Day number as an integer with the values of 1 to31.


Web interface: Stop DayPhone UI: Not configurable

<day_mode> To specify the advance or delay to end the DSTparameters application. The value range is from -5to 5.


Web interface: Stop Day ModePhone UI: Not configurable

Table continued…


40

String Description

<hour> To specify the hour to end the DST parametersapplication.

The hour format is a 24-hour format with valuesfrom 0 to 23.


Web interface: Stop HourPhone UI: Not configurable

<media> The top line of the media and codec section.

<security> The top line of the media security section.

<srtp> To enable or disable the ability to negotiate SecureReal-time Transport Protocol (SRTP) parameters toprovide encryption, message authentication, andintegrity for the audio and video streams. Theoptions are the following:

• Disabled. This is the default option.• Optional.• Mandatory.


Web interface: SRTPPhone UI: SRTP

<srtcp> To enable the ability to generate secure RTCPreports. The options are the following:



Web interface: SRTCPPhone UI: SRTCP

Table continued…


41

String Description

<capneg> To determines if during the SIP offer and answerprocedure the SDP protocols and attributes can benegotiated.



Web interface: Capability Negotiation(RFC5939)Phone UI: Capability Negotiation

<codec> The top line of the codec selection and prioritysection. Here, 6 stands for the highest priority, 1 -for the lowest, and 0 - for the disabled (not offeredduring negotiation).

You must enable at least 1 codec.

<iLBC> The top line of the iLBC codec section.

<prio> To specify the iLBC priority. Here, 6 stands for thehighest priority, 1 - for the lowest, and 0 - for thedisabled (not offered during negotiation).


Web interface: ILBCPhone UI: ILBC Priority

<mode> To specify the iLBC coded frame length inmilliseconds. The options are the following:

• 20 for 15.2 kbps. This is the default setting.• 30 13.33 kbps.


Web interface: ILBC ModePhone UI: Not configurable

Table continued…


42

String Description

<OPUS> The top line of the OPUS codec section. OPUSoffers excellent bandwidth versus audio qualityperformance. It supports bandwidths up to wide-band fidelity. Konftel recommends using itwhenever possible.

<prio> To specify the OPUS priority. Here, 6 stands for thehighest priority, 1 - for the lowest, and 0 - for thedisabled (not offered during negotiation).


Web interface: OPUSPhone UI: OPUS Priority

<PCMU> The top of the PCMU section. PCMU is a narrow-band codec operating at 64kbps with 20mspayload. The other name of this codec is G.711ulaw.

<prio> To specify the PCMU priority. Here, 6 stands for thehighest priority, 1 - for the lowest, and 0 - for thedisabled (not offered during negotiation).


Web interface: PCMUPhone UI: PCMU Priority

<PCMA> The top of the PCMA section. PCMA is a narrow-band codec operating at 64kbps with 20mspayload. The other name of this codec is G.711alaw.

Table continued…


43

String Description

<prio> To specify the PCMA priority. Here, 6 stands for thehighest priority, 1 - for the lowest, and 0 - for thedisabled (not offered during negotiation).


Web interface: PCMAPhone UI: PCMA Priority

<G722> The top of the G722 section. G722 is a wide-bandcodec providing excellent quality.

<prio> To specify the G722 priority. Here, 6 stands for thehighest priority, 1 - for the lowest, and 0 - for thedisabled (not offered during negotiation).


Web interface: G722Phone UI: G722 Priority

<G729> The top of the G729 section. G729 is a narrow-band codec providing good audio quality undergood network conditions.

OPUS is a preferred option.

<prio> To specify the G729 priority. Here, 6 stands for thehighest priority, 1 - for the lowest, and 0 - for thedisabled (not offered during negotiation).


Web interface: G729Phone UI: G729 Priority

<voice_quality_monitor> The top of the Voice Quality Monitor configurationsection. Voice Quality Monitor is a physical or Cloudserver or a collector that you can use to track callaudio quality information.

Table continued…


44

String Description

<enable_rtcp_xr> To enable the Real-Time Transport Control Protocolwith the Extended Reports capability. The optionsare the following:



Web interface: Enable RTCP XRPhone UI: Enable RTCP XR

<rtcp_xr_collector_uri> To specify the Uniform Resource Identifier (URI) ofthe RTCP collector.


Web interface: RTCP XR Collector URIPhone UI: RTCP XR Collector URI

<rtp_pt_98_ilbc> To set iLBC to use payload type 98. The options arethe following:



Web interface: Not configurablePhone UI: Not configurable

<advanced> The top line of the advanced media settingssection.

<first_media_port> To specify the First Media Port value. The valuerange is from 2048 to 65528. The default value is4000.

<last_media_port> To specify the Last Media Port value. The valuerange is from 2055 to 65535. The default value is65535.

Table continued…


45

String Description

<sip> The top line of the SIP parameters section.

<primary_account> The top line of the primary account section. Afterregistration, the primary account is applicable forinbound and outbound calls.

<name> To specify the name visible on the phone screen onthe primary line. This name is not a part of the SIPmessaging.

This is a mandatory setting.


Web interface: Account NamePhone UI: Account Name

<user> To specify the SIP account name as configured onthe SIP Registrar. The phone uses the content ofthis field to construct the user URI.

Do not include @sipdomain data.



Web interface: UserPhone UI: User

<registrar> To specify the IP address or a fully qualified domainname (FQDN) of the SIP server where you registerthe account. The format options are the following:10.10.1.100 and 10.10.1.100:5060 for alocal SIP server, or sip.company.net for aFQDN.



Web interface: RegistrarPhone UI: Registrar Address

Table continued…


46

String Description

<proxy> To specify the proxy server which the companyuses for Internet communication. The formatoptions are the following: 10.10.1.100:1234 fora local proxy with an optionally specified port orproxy.company.net:port for a FQDN.


Web interface: ProxyPhone UI: Proxy

<keep_alive> To specify if the phone maintains an activeconnection to the network. The device can useKeep Alive messages to ensure that the IP path tothe Registrar is always available by sendingperiodic SIP messages. If the network fails andthere are no messages received, the phoneattempts to switch to the Secondary account foroutbound calls, or the Fallback account.

The options are the following:



Web interface: Keep AlivePhone UI: Keep Alive

<cred> The top of the SIP credentials for the primaryaccount section.

Table continued…


47

String Description

<realm> To specify the network domain which the phoneaccepts incoming calls from. For example,company.com. The other name is the SIPdomain.

You can leave this field blank or put an asterisk (*)to accept all incoming call invites from any SIPdomain.


Web interface: RealmPhone UI: Realm

<username> To specify the SIP authentication name. If you leaveit blank, the phone uses the content of the <user>parameter to authenticate and register the account.


Web interface: Authentication NamePhone UI: Authentication Name

<password> To specify the SIP password for authentication withthe Registrar.


When you export a configuration file for thedevice, the system comments the password outfor security reasons.


Web interface: PasswordPhone UI: Password

Table continued…


48

String Description

<reg_timeout> To specify the period in seconds after which the SIPregistration expires. The phone automaticallyrenews the registration within the set period if it isstill on and connected to the server.

The default setting is 300 seconds.


Web interface: Registration TimeoutPhone UI: Registration Timeout

<secondary_account> The top line of the secondary account section. Afterregistration, the secondary account is normallyapplicable for inbound calls only, but it also makesoutbound calls if the primary account becomesunregistered or fails.










Table continued…


49

String Description













Table continued…


50

String Description

<cred> The top of the SIP credentials for the Secondaryaccount section.













Table continued…


51

String Description





<fallback_account> The top line of the fallback account section. Afterregistration, the fallback account is applicable forinbound and outbound calls only if the primary andsecondary accounts become unregistered or fail.










Table continued…


52

String Description













Table continued…


53

String Description

<cred> The top of the SIP credentials for the Fallbackaccount section.













Table continued…


54

String Description





<source_port> To specify the source port which indicates the UDP,TCP, or TLS port or socket that the phone usesduring outbound SIP signaling.

• UDP and TCP: 5060.• TLS and SIPs: 5061.


Web interface: Source PortPhone UI: Port

<transport_protocol> To specify the SIP Messaging protocol which thephone must use. It must match the capabilities ofthe communications server for the Primary,Secondary and Fallback accounts. UDP and TCPtypically do not require any further adjunctconfiguration. Being secure and encrypted, TLSand SIPs may require adjustment of the supportedTLS versions of certificate installation.


Web interface: Transport ProtocolPhone UI: Transport Protocol

<tls> The top of the TLS configuration section.

The parameters in this section are applicable if youchoose TLS or SIPs as the transport_protocol.

Table continued…


55

String Description

<tls_method> To identify the lowest version of the TLS protocolthat the phone supports.

The options are:

• TLSv1• TLSv1_1• TLSv1_2


Web interface:TLS MethodPhone UI: TLS Method

<tls_neg_timeout> To specify the TLS negotiation time-out in secondsfor both outgoing and incoming connections duringcall setup. If this negotiation is not successful withinthe specified time defined in seconds, the phonestops the negotiation. You can disable the timer byentering 0.


Web interface: Negotiation TimeoutPhone UI: TLS Negotiation

<tls_password> To specify the password for the private key if it isencrypted.


Web interface: Device Private Key PasswordPhone UI: TLS Password

Table continued…


56

String Description

<verify_client> To specify whether the phone challenges andverifies the peer during each incoming SIPconnection attempt. This is a required feature whenthe SIP realm is not defined and the device acceptsincoming call requests from any domain.




Web interface: Verify ClientPhone UI: Verify Client

<verify_server> To specify whether the phone challenges andverifies the peer during each incoming SIPconnection attempt. This is a required feature whenthe SIP realm is not defined and the device acceptsincoming call requests from any domain.




Web interface: Verify ServerPhone UI: Verify Server

<require_client_cert> To enable validation of the client certificate duringeach incoming call attempt.




Web interface: Require Client CertificatePhone UI: Require Client Certificate

Table continued…


57

String Description

<advanced> The top line of the Advanced settings section whichcontains miscellaneous SIP configurationparameters. These parameters often contain thedefault values.

<disable_rport> To enable the remote port forwarding. The optionsare the following:



Web interface: Disable rportPhone UI: Disable ‘rport’

<session_timers> To specify whether the phone uses SIP timersduring SIP negotiation. The options are thefollowing:

• 0 - Disabled. This is the default setting.• 1 - Optional• 2 - Mandatory


Web interface: Session TimersPhone UI: Session Timers

<session_expiration_minimum>

To specify the minimum timer value which thephone negotiates during SIP negotiation. Thedefault value is 90 seconds.

This parameter is only available in the .xmlconfiguration file. Do not modify.

Table continued…


58

String Description

<session_expiration> To specify the target session timer which the phonenegotiates during SIP negotiation. The defaultsetting is 1800 seconds (30 minutes).


Web interface: Session ExpirationPhone UI: Session Expiration

<outbound_proxy> To specify the IP address or FQDN of the outboundcall proxy.


Web interface: Outbound ProxyPhone UI: Outbound Proxy

<enable_sip_traces> To enable provision of key information fortroubleshooting. The default setting is disabled. Theoptions are the following:



Web interface: Enable SIP TracesPhone UI: Not configurable

<allow_contact_rewrite> To enable storing the IP address from the responseof the register request. If there is any changedetected, the phone unregisters the available SIPURI and updates it with a new address.




Web interface: Allow Contact RewritePhone UI: Allow Contact Rewrite

Table continued…


59

String Description

<allow_via_rewrite> To enable rewriting of the VIA header in the SIPRegister requests. If there is any change detected,the phone overwrites the VIA header with the newdata.




Web interface: Enable Via RewritePhone UI: Allow Via Rewrite

<enable_sip_replaces> To enable the use of the SIP Replaces header.The options are the following:



Web interface: Enable SIP ReplacesPhone UI: Enable SIP Replaces

<contact_use_src_port_even_with_dns>

To enable ignoring of the DNS provided source port.The options are the following:


This parameter is only available in the .xmlconfiguration file.

<enable_lock_codec> To enable the lock codec feature. The options arethe following:



Table continued…


60

String Description

<use_static_source_port> To enable the phone to use the port identified in<source_port> or the default values for<source_port>. When disabled, the device usesephemeral ports from the port usage table.




Web interface: Use Static Source PortPhone UI: Use Static Source Port

<dtmf> The top of the DTMF section.

<method> To configure the Dual-tone multi-frequency (DTMF)signaling method. The options are the following:

• RFC 4733. With this method, DTMF signals arecarried in RTP packets by using a separate RTPpayload format. This is the default option.

• SIP Info. With this method, the DTMF signalsare sent as SIP requests. The SIP switchcreates the tones if the call is transferred to thePSTN.

• In-band. With this method, the phone generatesthe tones and sends them in the voicefrequency band. This is the least preferredmethod for interoperability.


Web interface: DTMF MethodPhone UI: DTMF Method

Table continued…


61

String Description

<rfc4733_payload_type> To specify the DTMF payload media value to use inSIP negotiations. The value range is from 96 to127. The default setting is 101.


Web interface: RFC 4733 payload typePhone UI: RFC 4733 payload type

<nat_traversal> The top line of the Network Address TranslationTraversal (NAT) section.

<ice> The top line of the Interactive ConnectivityEstablishment (ICE) section.

<enable> To enable ICE. ICE uses various techniques toallow SIP-based VoIP devices to successfullytraverse the variety of firewalls that may existbetween the devices. The protocol provides amechanism for the endpoints to identify the mostoptimal path for the media traffic to follow.




Web interface: ICEPhone UI: Enable ICE

<stun> The top line of the Simple Traversal of UDP throughthe NAT (STUN) section.

Table continued…


62

String Description

<enable> STUN is a protocol to assist devices behind a NATfirewall or router with packet routing. The protocolallows applications operating through the NAT todiscover the presence and type of the NAT andobtain a public IP address (NAT address) and portnumber that the NAT allocates for the applicationUser Datagram Protocol (UDP) connections toremote hosts. You must enable STUN if an externalSIP server cannot connect to the phone behind afirewall NAT function and the SIP server supportsSTUN.




Web interface: STUNPhone UI: Enable STUN

<server> To configure the IP address or FQDN of the STUNServer.


Web interface: STUN ServerPhone UI: STUN Server

<turn> The top line of the Traversal Using Relay NAT(TURN) section.

Table continued…


63

String Description

<enable> To enable TURN. TURN is an extension of the ICEprotocol that enables NAT traversal when bothendpoints are behind symmetric NAT. With TURN,media traffic for the session has to go to a relayserver. Since relaying is expensive, in terms ofbandwidth that must be provided by the provider,and additional delay for the media traffic, you mustuse TURN as a last resort when endpoints cannotcommunicate directly.



To enable TURN, you must enable ICE.


Web interface: TURNPhone UI: Enable TURN

<server> To specify the IP address:port or FQDN of theTURN server.


Web interface: TURN ServerPhone UI: TURN Server

<user> To specify the TURN server user authenticationname.


Web interface: UserPhone UI: TURN User

<password> To TURN server user authentication password.


Web interface: PasswordPhone UI: TURN Password

Table continued…


64

String Description

<phone> The top line of the phone general parameterssection.

<name> To enter the name to be displayed on the phonescreen above the line appearances. This name isavailable in any SIP messaging. The maximuminput length is 28 characters.


Web interface: Phone NamePhone UI: Name

<language> To select the language. The options are:

• en - English. This is the default setting.• se - Swedish• da - Danish• no - Norwegian• fi - Finnish• it - Italian• de - German• fr - French• sp - Spanish• br - Portuguese• nl - Dutch• zh - Simplified Chinese


Web interface: Phone LanguagePhone UI: Language

Table continued…


65

String Description

<allow_legacy_encryption>

To enable or disable legacy encryption for backwardcompatibility. The phone's R 1.0.4 firmware isdisabled by default for older less secure encryptionalgorithms.




Web interface: Allow Legacy EncryptionPhone UI: Allow Legacy Encryption

<password> To specify the Administrator password. Maximuminput length is 32 characters.


Web interface: Not configurablePhone UI: Admin Password

<ringlevel> To configure the default ringing level after reboot.The levels are the following:

• Level 0 - The phone stays silent. LED flashindication only.

• Level 1• Level 2• Level 3• Level 4. This is the default setting.• Level 5• Level 6. The loudest ringing level.


Web interface: Ringtone LevelPhone UI: Ring Level

Table continued…


66

String Description

<key_tone> To specify whether the phone provides audiblefeedback of key presses. The options are thefollowing:



Web interface: Key TonePhone UI: Key Tone

<is_daisy_chain_slave> To specify the mode of the phone in case of a daisychain arrangement. When using multiple devicescabled to provide increased room coverage, youmust configure the Main (Leader) and Expansion(Follower) arrangement.




Web interface: Daisy Chain ModePhone UI: Daisy Chain

<phone_status_api> To enable WebApp Debug which is a debug tool fordevelopment and troubleshooting the Web Adminpages via the System Logs.




Web interface: Webapp DebugPhone UI: Not configurable

Table continued…


67

String Description

<sleep_mode_timeout> To enable Sleep mode and configure the time-outvalue. The default value is 0, which means that thefeature is disabled. To enable Sleep mode and tospecify the time-out in minutes, set the value in therange from 1 to 500.


<enable_startup_sound> To specify whether the branded start-up soundplays when the device boots.




Web interface: Startup SoundPhone UI: Startup Sound

<fips_mode> To enable FIPS mode which uses encryption andcryptographic functions compliant with the FederalInformation Processing Standards (FIPS). Whenyou enable FIPS mode, the phone employsapproved key exchange algorithms, cryptographicalgorithms and authentication techniques to meetthe FIPS 140-2 and 140-x requirements.



Legacy Encryption or EAP MD5 can notoperate with FIPS enabled.


Web interface: FIPS ModePhone UI: FIPS Mode

Table continued…


68

String Description

<bluetooth> The top line of the Bluetooth section.

<enable> To enable the Bluetooth Radio and functionality.The options are the following:



When you enable Bluetooth, the ability to pair,disconnect and remove pairing becomes availablein the phone's Bluetooth menu.

<usb> The top line of the USB section.

<enable> To specify whether USB ports are enabled. Thedefault setting is True.


<echo_cancelling_speakerphone>

To specify whether the phone is used as an EchoCancelling Speakerphone. When you set thissetting to true, Windows considers Konftel 800 asdefault speaker and communication device. Here,Windows Device Manager shows the phone as onedevice with the name Echo CancellingSpeakerphone. Here, the USB Product ID (PID) is095C.

When you set this setting to false, WindowsDevice Manager shows the phone as two separatedevices with different names: Speakers andMicrophone. Here, the USB Product ID (PID) is0970.

The default setting is True.


Table continued…


69

String Description

<network> The top line of the Network section.

<dhcp> To enable DHCP process. The options are thefollowing:



Web interface: Enable DHCPPhone UI: DHCP

<hosts_map> To specify the FQDN/IP mapping information thatstays persistent for the device. This arrangementprovides for the SIP operation even if DNS is notavailable.


<host> To specify the FQDN to IP mapping.

The administrator can add several host entities orleave the parameter empty.

The device supports the mappings for theprimary, secondary and fallback SIP accounts.


<ip> To specify an IP address for the FQDN to IPmapping.


<name> To specify a name for the FQDN to IP mapping inthe following format: sipserver1.com.


Table continued…


70

String Description

<hostname> To specify the hostname of the phone to use whenperforming DHCP, DNS and other networktransactions.The default name is Konftel 800.


Web interface: Network HostnamePhone UI: Hostname

<domain> To specify the domain name of the phone to beused to indicate the network domain Konftel 800 ispart of.

With DHCP enabled, DHCP server mayprovide this parameter, and therefore you canleave this field blank.


Web interface: Domain HostnamePhone UI: Domain

<dns1> To specify the IP Address of the primary DomainName Server.



Web interface: DNS1Phone UI: DNS 1

Table continued…


71

String Description

<dns2> To specify the IP Address of the secondary DomainName Server.



Web interface: DNS2Phone UI: DNS 2

<static_ip> The top line of the static IP configuration section.

<ip> To specify the IPv4 address for the phone to use.


Web interface: IPPhone UI: IP

<netmask> To specify the network mask for your phone todetermine on subnet versus off subnet addressesand when the gateway is the path to use.


Web interface: Network MaskPhone UI: Netmask

<gateway> To specify the IPv4 address of the subnet gateway.


Web interface: GatewayPhone UI: Gateway

Table continued…


72

String Description

<vlan> To enable the VLAN tagging of the Ethernetpackets. The options are the following:



Web interface: VLAN EnablePhone UI: VLAN

<vlanid> To specify the VLAN ID for the phone to use whentagging Ethernet packets. The device accepts onlyingress packets tagged with the configured VLAN.The options are the following: from 0 to 4094.

With LLDP enabled, the L2/3 switch maybroadcast a Network Policy LLDP packet thatsets the VLAN ID for the phone. The LLDPbroadcast packet overrides the manuallyconfigured VLAN value.


Web interface: VLAN IDPhone UI: VLAN ID

<ieee_8021x> The top line of the 802.1x section.

<enable> To enable 802.1x that is a network security andauthentication mechanism aimed to ensure thatonly authorized IP devices obtain access to thenetwork.




Web interface: Enable 802.1XPhone UI: 802.1x

Table continued…


73

String Description

<username> To specify the 802.1x username as provision in thesecurity server for the network.


Web interface: UsernamePhone UI: Authentication Name

<eap_md5> The top line of the EAP MD5 section.

<enable> To enable the EAP MD5 authentication method forthe phone to use with the 802.1x authenticationserver.

You must enable Legacy Encryption to useEAP MD5.




Web interface: EAP MD5 EnablePhone UI: EAP MD5

<password> To specify the EAP MD5 password for the phone touse during authentication.


Web interface: PasswordPhone UI: EAP-MD5 Password

<eap_tls> The top line of the EAP TLS section.

Table continued…


74

String Description

<enable> To enable the EAP TLS authentication method. TheTLS is a state-of-art method which is consideredmore secure than the MD5 method.




Web interface: Enable EAP TLSPhone UI: EAP TLS

<password> To specify the EAP TLS password to be usedduring authentication.


Web interface: Device Private Key PasswordPhone UI: Private Key Password

<lldp> The top line of the LLDP section.

There are character limitations (number ofcharacters and type of characters) for a number ofthe parameters below. Konftel to validate the .xmlconfiguration file using the .vsd file provided.

Table continued…


75

String Description

<enable> To enable the Link Layer Discovery Protocol(LLDP). When enabled, the phone broadcastsinformation about itself to the neighboring devices.The device also receives and may act in line withthe LLDP information broadcast from Layer 2 or 3devices managing the subnet.




Web interface: EnablePhone UI: Not configurable

<country> To specify the country of the phone installation. Thecountry indication may be 2 or 3 uppercase lettersor 3 digits as defined by the ISO-3166 format.


Web interface: Country CodePhone UI: Not configurable

<country_subdivision> To specify the region, province, state or othercountry subdivision of the phone installation. Thecountry indication may be 2 or 3 uppercase lettersor 3 digits as defined by the ISO-3166 format.


Web interface: Country SubdivisionPhone UI: Not configurable

Table continued…


76

String Description

<county> To specify the county, parish, district, or otherapplicable administrative division. Maximum inputlength is 50 characters.


Web interface: CountyPhone UI: Not configurable

<city> To specify the city of installation. The maximuminput length is 40 characters.


Web interface: CityPhone UI: Not configurable

<city_division> To specify the subdivision or section of the city. Themaximum input length is 60 characters.


Web interface: City DivisionPhone UI: Not configurable

<block> To specify the block name within the city.


Web interface: BlockPhone UI: Not configurable

<street> To specify the street name.


Web interface: StreetPhone UI: Not configurable

Table continued…


77

String Description

<direction> To specify the direction or orientation of the street.


Web interface: DirectionPhone UI: Not configurable

<trailing_street_suffix> To specify the trailing street suffix. The maximuminput length is 10 characters.


Web interface: Trailing Street SuffixPhone UI: Not configurable

<street_suffix> To specify the freeform or standard street suffix. Forexample, Alley, ALY, CENTER, CTR. The maximuminput length is 15 characters.


Web interface: Street SuffixPhone UI: Not configurable

<number> To specify the building number with relation to thestreet.


Web interface: NumberPhone UI: Not configurable

<number_suffix> To specify the subdivision of the street number suchas a unit. For example, B to indicate that the phoneis at 16B Street. The maximum input length is 20characters.


Web interface: Number SuffixPhone UI: Not configurable

Table continued…


78

String Description

<landmark> To specify the reference or commonly knownlocation or landmark. The maximum input length is30 characters.


Web interface: LandmarkPhone UI: Not configurable

<additional> To specify any additional reference points. Themaximum input length is 30 characters.


Web interface: AdditionalPhone UI: Not configurable

<name> To specify the device name. The default name isKonftel800. The maximum input length is 60characters.


Web interface: NamePhone UI: Not configurable

<zip> To specify the ZIP or postal code of the location.The maximum input length is 20 characters.


Web interface: ZipPhone UI: Not configurable

<building> To specify the name of the building. The maximuminput length is 60 characters.


Web interface: BuildingPhone UI: Not configurable

Table continued…


79

String Description

<unit> To specify a unit within a building. The maximuminput length is 30 characters.


Web interface: UnitPhone UI: Not configurable

<floor> To specify the floor within the building. The valuerange is from -5 to 250.


Web interface: FloorPhone UI: Not configurable

<room> To specify the room name. The maximum inputlength is 60 characters.


Web interface: RoomPhone UI: Not configurable

<place_type> To specify the premises type. For example, officeor laboratory. The maximum input length is 60characters.


Web interface: Place TypePhone UI: Not configurable

<script> To specify the script. The maximum input length is60 characters.


Web interface: ScriptPhone UI: Not configurable

Table continued…


80

String Description

<elin> To specify the Emergency Location IdentificationNumber (ELIN) to support e911 systems that utilizeLLDP for location gathering and monitoring. Themaximum input length is 31 characters.


Web interface: ELINPhone UI: Not configurable

<qos> The top line of the Quality of service section.

<dscp_sip> To specify the diffserv codepoint to tag SIPmessages. The options are the following: from 0 to63 in line with IETF RFC-4594. The default settingis 0, which is untagged.


Web interface: SIP DiffServPhone UI: Not configurable

<dscp_media> To specify the diffserv codepoint to tag RTP/SRTPaudio packets. The options are the following: from 0to 63 in line with IETF RFC-4594. The defaultsetting is 0, which is untagged.


Web interface: Media DiffServPhone UI: Not configurable

<device_management> The top line of the Device Management section

Table continued…


81

String Description

<enable> To enable Device Management service within thephone.




Web interface: EnablePhone UI: Enable

<update_interval> To indicate how often the phone contacts the serverto see if an update is available. The value range isfrom 1 minute to 21,000 minutes. The defaultsetting is 60 minutes.


Web interface: Update IntervalPhone UI: Not configurable

<update_max_wait> To specify a waiting time that expires if the serverand the phone cannot complete the provisioningcheck due to network failure. The default setting is1 second.


Web interface: Maximum Time To Wait ToUpdatePhone UI: Not configurable

<server> To specify the IP address, FQDN or URL of theprovisioning server unless DHCP provides the data.The string can be complex. Here, the phone usesTLS to reach port 443 and specifies the path to thefiles.

Table continued…


82

String Description

<check_server_certificate> To enable the Check certificate when the phonevalidates the server certificate credentials each timeit contacts the server.




Web interface: Check CertificatePhone UI: Check Server Certificate

<lowest_tls_version> To specify the lowest TLS version for the phone touse during secure communications with theprovisioning server. The options are the following:

• TLSv1. This is the default setting.• TLSv1_1• TLSv1_2


Web interface: Lowest TLS VersionPhone UI: Lowest TLS Version

Table continued…


83

String Description

<dhcp_option> To select the DHCP option which indicates withDHCP Option number how the system parsespackets to obtain the phone specific configurationparameters.


• 43.• 56.• 60.• 61.• 66.• 67.• 242.• Off.• Auto. This is the default setting. Here, it

searches the DHCP provided offer for thecorrect parameters.

For more information, see DHCP configurationoptions on page 22.


Web interface: DHCP OptionPhone UI: DHCP Option

<SCEP> The top line of the Simple Certificate EnrollmentProtocol(SCEP) section.

<SCEP_ENTITY_CLASS> To identify the entity class for which the SCEPserver generates the identity certificates.


Web interface: Entity ClassPhone UI: Not configurable

Table continued…


84

String Description

<PASSWORD> To specify the SCEP system password. The defaultis the phone's serial number.


Web interface: PasswordPhone UI: Not configurable

<MYCERTURL> To enter the URL of the SCEP server.


Web interface: SCEP ServerPhone UI: Not configurable

<MYCERTRENEW> The phone generates a certificate renewal requestprior to the expiry of the current certificate based onthe following formula: (Date of Expiry – Date ofIssue) * Key Renew Percentage. TheMYCERTKEYRENEW parameter indicates thepercentage of certificate life that passes prior to arenewal request. The value range is from 1 to 99.The default value is 90.


Web interface: Initiate renewal on % of ValidityIntervalPhone UI: Not configurable

<MYCERTKEYLEN> To specify the length of the public and private keys.The options are the following:

• 1024. This is the default setting.• 2048.


Web interface: Key LengthPhone UI: Not configurable

Table continued…


85

String Description

<MYCERTDN> To specify the DN which is the Subject of thecertificate request. For example, /C=US/ST=NJ/L=MyTown/O=MyCompany is a DN for a NewJersey based company in the United States, inMyTown at MyCompany.subject of the SCEPcertificate request.


Web interface: SubjectPhone UI: Not configurable

<MYCERTCN> To enter the Common Name (CN) for the phone touse when requesting a certificate. By default, theCN is the Konftel 800 serial number.


Web interface: Common NamePhone UI: Not configurable

<MYCERTCAID> To specify the CA identifier. The phone generatesthe SCEP certificate request and signs it with acertificate on the device. The CA ID tells the SCEPserver which CA the certificate used at generationof the request. The default value is CAIdentifier.


Web interface: CA IdentifierPhone UI: Not configurable

Table continued…


86

String Description

<SCEPENCALG> To specify the SCEP encryption algorithm. If thevalue is 0, then SCEP operates using the DESencryption. If the value is 1, then SCEP operatesusing the AES-256 encryption. If you put any othervalue than 0 or 1, or skip the parameter, then SCEPalso operates using the DES encryption.


Web interface: Encryption AlgorithmPhone UI: Not configurable

<logging> The top line of the Logging section.

<remote_syslog_enable> To enable the use of a remote syslog server. Theoptions are the following:




<remote_syslog_host> To specify the IP address or FQDN of the syslogserver.



Table continued…


87

String Description

<pjsip_log_level> To change the level of logging for the SIPapplication in the phone. The options are thefollowing:

• 0 - Fatal• 1 - Error• 2 - Warning• 3 - Info. This is the default setting.• 4 - Debug.• 5 - Trace.


Web interface: PJSIP Log LevelPhone UI: Not configurable

<ldap> The top line of the Lightweight Directory AccessProtocol (LDAP) section.

<enable> To enable the LDAP service in the phone.




Web interface: EnablePhone UI: Not configurable

Table continued…


88

String Description

<name_filter> When the phone uses the LDAP search, it contactsthe LDAP server with the search parameter asdefined by the name filter. The default is (|(sn=%*)(cn=%*)) which uses the search text andrequests a search against the Surname (SN) andthe Common Name (CN) values on the LDAPserver.


Web interface: Name FilterPhone UI: Not configurable

<server_url> To enter the URL that specifies the protocol (LDAPor LDAPS), the FQDN and the port to be usedwhen communicating with the phone. For example,ldaps://cd.lab.acme.com:636.


Web interface: URLPhone UI: Not configurable

<search_base> To specify the search base that indicates the rangeor domain of the searchable base. The defaultvalue is dc=example, dc=com that shows thedomain components of example.com.


Web interface: Search basePhone UI: Not configurable

Table continued…


89

String Description

<user_name> The phone needs a username and a password toauthenticate with the LDAP server to performsearches. The username format can be simple suchas JohnDoe which stands for a user network, or itcan base on the LDAP directory structure such asuid=400130352125,dc=acme,dc=com.


Web interface: UsernamePhone UI: Not configurable

<password> To specify the password that the phone uses whenauthenticating with the LDAP server.


Web interface: PasswordPhone UI: Not configurable

This parameter is not in .xml configuration filesif you export them through the web interface.

<max_hits> To determine the number of search results torequest. The value range is from 0 to 1000. Thedefault value is 20 which nicely displays on thephone.


Web interface: Max hitsPhone UI: Not configurable

<country_code> To specify the country code based on ISO 3166. Ifyou enter it, the LDAP searches, that match thecountry code, remove it from the displayed searchresults.


Web interface: Country codePhone UI: Not configurable

Table continued…


90

String Description

<area_code> To specify the Numbering Plan Area (NPA) or AreaCode. If you enter it, the LDAP searches, thatmatch the area code, remove it from the displayedsearch results. The maximum input length is 10digits.


Web interface: Area codePhone UI: Not configurable

<external_prefix> To specify a special prefix for dialing externalnumbers. If you define it, the phone appends it atthe start of all outbound calls when making calls toexternal numbers. For example, 9 to seize anoutbound trunk.


Web interface: External prefixPhone UI: Not configurable

<min_length_for_ext_prefix>

To restrict the external prefix that the phone addsonly if the phone number is longer than theminimum length. If you set this parameter, thephone only adds the external prefix to the dialednumber if the dialed digits exceed the minimallength for external prefix value. For example,parameter value 8 allows for 7 digit direct internaldialing. The value range is from 0 to 32. The defaultvalue is 0.


Web interface: Min length for external prefixPhone UI: Not configurable

Table continued…


91

String Description

<exact_length_for_no_ext_prefix>

To specify the exact length for the external prefix. Ifyou define it, the phone does not append theexternal prefix. For example, parameter value 11allows if the outbound user dials 012225551212which includes the trunk access code, country codeand NPA-NXX.


Web interface: Exact length for no externalprefixPhone UI: Not configurable

<number_prefix_for_no_ext_prefix>

To specify the initial number for the phone numbersin case of using which the phone adds no externalprefix.


Web interface: Number prefix for no externalprefixPhone UI: Not configurable

Table continued…


92

String Description

<number_attributes> A successful LDAP query results in a number ofdetails for the requested contact. The Defaulttelephone number related LDAP IDs reflect thefollowing:

• Phone number• Mobile phone• Home phone• Work phone• Other

The LDAP administrator can also use customparameters. The number attributes parametermatches the needed LDAP <id> and sets thetext to display <value> as follows:

<number_attributes type="xml"><number_attribute><id>telephoneNumber</id><value>PHONENUMBER</value></number_attribute><number_attribute><id>mobile</id><value>MOBILE</value></number_attribute></number_attributes>


Web interface: Number Attributes → Addattribute labelPhone UI: Not configurable

<display_name> To define which parameter that the LDAP queryreturns is used as the Display Name. Default is %cn(Common Name).


Web interface: Display namePhone UI: Not configurable

Table continued…


93

String Description

<sort_results> To enable sorting of the query results inalphabetical order based on the Display name.




Web interface: Sort resultsPhone UI: Not configurable

<use_dm_certificates_for_ldaps>

To enable the use of the Device Managementcertificates when communicating with the LDAPserver securely.





<httpd> The top line of http daemon section.

<enable> To enable the Web Admin access to access thephone through the web interface.




Web interface: EnablePhone UI: Web Access

Table continued…


94

String Description

<min_allowed_tls_version>

To define the minimum allowed TLS version whichthe web server uses for Web Admin capability. Thedefault setting is 1.2.


• all. This allows TLS 1.0 and TLS 1.1connections.

• 1.2. This is the default setting.



INPUT VALIDATION AND DATA TYPE RESTRICTIONSThe user's input validation takes place during the configuration of the settings onthe phone, through the web interface, and by using the configuration file.

When the user tries to input invalid data on the phone or through the webinterface, the phone does not accept or save the changed settings.

When the user tries to input invalid data during the configuration file import usingthe web interface or automatic provisioning of the phone, the server does notaccept or save the invalid input. Konftel 800 does not accept configuration of thesettings when:

• The user tries to import a file with invalid content for its type using the webinterface or automatic provisioning.

• The user tries to import a large file using the web interface or automaticprovisioning.

Input Data Type and Length Restrictions

Konftel 800 provides input data type and length validation. All validation rules takea stand on the existing requirements. For example, if the data input is a URL,validation rules are based on RFC for URLs.

When the user inputs data that do not meet the requirements, the systemhighlights the fields with the invalid data. The phone and the web server do notaccept or process any data that does not meet the defined data type and lengthrequirements.


95

If you input valid data, the phone reboots and applies the new configuration.

You can find the specific requirements and rules for valid data input in the settingsdescription sections.

Related informationConfiguration parameters on page 35

PHONE SETTINGSThe Konftel 800 phone settings include the following:

• Phone Name• Phone Language• Security• Ringtone Level• Key Tone• Reboot Device• Webapp Debug• Daisy Chain Mode• Factory Reset• Admin Password• Time and Region• Startup Sound

You can configure the phone settings during the installation of Konftel 800 or anytime after it.


Rebooting the phoneAbout this task

Use this procedure to reboot your Konftel 800 using the user interface of thephone. Here you can reboot the phone without making additional power cycles.

You can reboot Konftel 800 from the user interface of the phone only if you log inas the administrator.

You can also reboot the phone from the web user interface.


96

Procedure

On the phone screen, tap Settings > Admin Login > Phone.Tap Reboot.

The phone shows the following pop-up message: Reboot the phone.Press OK to confirm for 2 minutes and then hides it.To confirm the reboot, tap Ok.

The phone starts the reboot process and shows the following message:Rebooting phone.Optional: To return to the Phone settings, tap Cancel.


Configuring Daylight Saving Time through the web interfaceAbout this task

Use this procedure to configure DST offset through the web interface.

When you use the DST start parameters, enable the comparable DST stopparameters.

Procedure

Log in to the web interface.Click Phone.Enable Custom DST.In the Offset Hours field, specify the time in hours between the standard timeand the period when the DST parameter is active.

The values are 1 and 2. The default setting is 1.In the Start Month field, select the month to apply the DST offset.In the Start Day Mode field, select the day mode to apply the DST offset.In the Start Day field, specify the day to apply the DST offset.

The value range depends on the selected Start Day Mode. For example, ifyou select Day of month as the day mode, the value range is from 1 to 31.The value range for the weekday is from 0 to 7. Note that in this case, 0 and 7mean Sunday.

When Start Day Mode is 0, the start day is a day of the month. In case ofother values, the day is a day of the week: 1 is Monday, 5 is Friday. If StartDay Mode is 2 and Start Day is 5, you define the second Friday in the month.


97

The values -1 to -5 show a weekday in the month from the month end. If StartDay Mode is -1 and Start Day is 5, this is the last Friday in the month.In the Start Hour field, specify the hour to apply the DST offset.In the Stop Month field, select the month to stop applying the DST offset.In the Stop Day Mode field, select the day mode to stop applying the DSToffset.In the Stop Day field, specify the day to stop applying the DST offset.

The value range depends on the selected Stop Day Mode. For example, ifyou select Day of month as the day mode, the value range is from 1 to 31.In the Stop Hour field, specify the hour to stop applying the DST offset.Click Save.


Daylight Saving Time stateCheck the Daylight Saving Time state on the status page. The following optionsare available:

• On shows that the DST is active. This happens when you configure a UTCtimezone, enable Custom DST, and the current date is between the DST startday and DST stop day. In this case, you can add the offset to the current time.

• Off demonstrates that the DST is not active. This happens when you configurea UTC timezone with the Custom DST disabled, or the current date is notbetween the DST start day and DST stop day. In this case, you cannot add theoffset to the current time.

• Auto means that there is a Geo timezone set, and the phone ignores theCustom DST settings. In this case, the DST settings are managedautomatically.

• Unknown shows that the required information is currently unavailable. Youmust refresh the page and check it later.


Provision of the NTP server addressUse DHCP option 42 to provide NTP server address to Konftel 800 when using802.1x certificates. In this case, you must have DHCP enabled on the phone todisplay the accurate time received from this NTP server address.


98

When DHCP includes option 42 providing a valid NTP server address, Konftel 800uses this value even if you configure the NTP server in the .xml configuration file.When the DHCP option 42 does not provide an NTP server address, the valuefrom the configuration file becomes applicable.

Related conceptsDHCP configuration options on page 22Related informationConfiguration parameters on page 35

Sleep modeKonftel 800 supports Sleep mode feature, which saves power by turning thescreen off after a specified period of inactivity. By default, Sleep mode is indisabled state.

The phone administrator can enable Sleep mode and configure the time-out value.

The phone wakes up from Sleep mode when you do any of the following:

• Touch the screen• Connect or disconnect the USB cable• Connect or disconnect the Bluetooth® Classic

The phone also wakes up from Sleep mode during screen activity, such as anincoming call, Konftel Unite connection, or error prompts.

The phone cannot enter Sleep mode during an active call or when it is in musicstreaming mode.

You can configure Sleep mode only using the configuration file. The default valueis 0, which means that the feature is disabled. To enable Sleep mode and tospecify the time-out in minutes, set the value in the range from 1 to 500.


MEDIA SETTINGSThe Konftel 800 media settings include the following:

• Security• Audio codecs• Voice Quality Monitor• Advanced settings including the media ports range.


99


Voice quality monitoringConfigure Konftel 800 to generate quality metrics and evaluate the overall qualityof the calls. You can use this information to troubleshoot various quality aspects ofthe phone calls.

Find the detailed description of the collected parameters in the followingstandards: RFC 6035 and RFC 3611.

RTCP XR as voice quality monitoring report

If you enable the voice quality monitoring feature, the phone collects the metrics,generates Real-Time Control Protocol Extended Report (RTCP XR), and sendsRTCP XR as a SIP PUBLISH message to the specified report collector. View thestatistics of the established phone calls on a specific information collecting portal.

The phone collects the metrics in the following cases:

• One of the call parties ends the call.• Call parameters, such as codec and far-end IP address or port, change.• One of the call parties puts the call on hold or resumes it.

RTCP XR parameters

The following table lists parameters that the RTCP XR contains:


CallId Party leg identifier

LocalId Reporting device for the media session

RemoteId Remote device of the media session

OrigID Device that originated the session

LocalGroup Identification for aggregation of the local phone

LocalAddr Address information, including an IP address, a port number,and SSRC of the phone that receives the information

Table continued…


100


LocalMAC The Media Access Control (MAC) address of the local phone

RemoteAddr Address information, including an IP address, a port number,and SSRC of the phone that is the source of information.

Timestamps Call start and call end in Coordinated Universal Time (UTC)

SessionDesc A shortened version of the media session including codecs(ILBC, Opus, PCMU, PCMA, G722, or G729), silencesuppression status (on or off), and number of packets persecond

JitterBuffer Jitter Buffer metric definitions

PacketLoss Packet loss percentage and Jitter buffer discard ratepercentage

BurstGapLoss Burst-to-Gap loss metric

Delay Network delay between the call parties

Signal Non-packet elements of the voice over IP system. Includes aSignal level (SL) metric, which typically has a negative value

QualityEst Measures of the established call quality


Quality estimate metricsThe following table shows the direct measures of the quality of the established callor transmission. These metrics incorporate the effects of codec type, packet loss,discard, burstiness, and delay.

Metric Description

RLQ Listening Rating Factor (RLQ) metric based on burst packet lossand codec selection.


101

Metric Description

RCQ Conversational Rating Factor (RCQ) metric measures voicequality based on transmission delay, burst packet loss, andburst loss recency.

MOSLQ A mean opinion score for listening quality (MOSLQ). The scaleof speech quality is one (bad) through five (excellent).

MOSCQ A mean opinion score for conversational quality (MOSCQ).Includes recency and delay effects, which affect conversationalquality.

QoEEstAlg A text description of the algorithm, which estimates all voicequality metrics.


Configuring RTCP XRAbout this task

By default, the voice quality monitoring feature on Konftel 800 is disabled. To usethis feature, enable it and specify the Uniform Resource Identifier (URI) of theRTCP XR collector. You can do this on the phone, through the phone webinterface, or using the configuration .xml file.

The acceptable formats for the collector URI are as follows:

• hostname• hostname:port• user@hostname• user@hostname:port

Before you begin

Obtain the RTCP XR collector URI from your service provider.

Procedure

• To configure RTCP XR from the phone interface, do the following:Log in as the administrator.


102

Navigate to Media > Voice Quality Monitor and move the Enable RTCP XRslider to the right to activate RTCP XR.In the RTCP XR Collector URI field, specify the RTCP XR collector URI.

For example, [email protected] the Arrow Left icon three times to return to the home screen.

The phone restarts the application to apply the changes.• To configure RTCP XR from the web interface, do the following:

Log in to the phone web interface.On the Media tab, in the Voice Quality Monitor section, move the EnableRTCP XR slider to the right to activate RTCP XR.In the RTCP XR Collector URI field, specify the RTCP XR collector URI.

For example, [email protected] Save.

The phone restarts the application to apply the changes.• To configure the RTCP XR using the configuration file, do the following:

Obtain the configuration .xml file.

Find the RTCP XR settings under the <voice_quality_monitor>section.In the <enable_rtcp_xr> tag, specify true to enable RTCP XR.In the <rtcp_xr_collector_uri> tag, specify the collector URI.

For example, [email protected] the configuration file.Import the configuration file to the phone through the web interface or to theprovisioning server to configure several phones simultaneously.

Related conceptsDevice Management on page 129Related tasksExporting the configuration file on page 122Related informationConfiguration parameters on page 35

Configuration of the media port rangeWhen the Konftel 800 system operates, it assigns two media ports - RTP andRTCP - to each session. The phone uses the media port values from the specifiedmedia port range. To configure this parameter, you must enter the First Media Portand the Last Media Port values. The acceptable values are the following:


103

• For First Media Port: from 2048 to 65528.• For Last Media Port: from 2055 to 65535.

When you specify the values for the first and the last media ports, the phone usestwo consecutive unoccupied ports from this media port range: RTP port to transferaudio signal and RTCP to send statistic data. For each new call the device appliesthe next two ports, even if you end the previous session and its ports becomeavailable. Konftel 800 uses the ports this way until it reaches the last port withinthe configured media port range, and then it switches to the first port. Forexample, if you set the First Media Port parameter to 4000 and the Last MediaPort to 4007, Konftel 800 uses the following port pairs: 4000 for RTP and 4001 forRTCP, 4002 for RTP and 4003 for RTCP, and further.

For successful configuration, the media port range must be at least 8 as this is thenumber of ports Konftel 800 uses for a conference call with the maximum allowednumber of participants. If it is less than 8, the phone shows the following errormessage: There should be at least 8 media ports in total. As aresult, the device does not accept the configuration and uses the following defaultvalues:

• First Media Port: 4000.• Last Media Port: 65535.

As the phone always uses two ports, it prefers to have an even media port rangeto correctly form port pairs. Thus, if the check shows that the number is odd,Konftel 800 shows the following warning message: Number of media portsis expected to be even. Here, the device ignores the last value of the rangeto make the number of media ports even.

You must take into consideration that, unlike Konftel 800, some implementationsdo not follow RFC 3605 and do not recognize when the peer specifies its RTCPport separately. If such an implementation receives an odd RTP port number fromyour conference device, it follows the RFC 3550 rule to change the RTP port tothe next lower even number, and this results in the loss of RTP. Thus, you mustaccount for this possibility of a session failure if you enter an odd First Media Portnumber. If so, the phone warns you with the following message: First MediaPort is expected to be an even number. Nevertheless, the deviceaccepts an odd RTP port value and continues its operation.

There is no dependencies check for the media port range during the .xmlconfiguration file import.

When you specify the media port range correctly, Konftel 800 accepts it andrestarts to apply changes.


104

You can configure the Media Port Range parameter on the phone, through theweb interface, by importing the .xml configuration file, or through auto-provisioning.


Configuring the media port range on the phone

About this task

Use this procedure to configure the media port range on your .

Procedure

Log in as administrator.In the Settings menu, tap Media > Advanced.Set the First Media Port parameter.Set the Last Media Port parameter.Tap the Arrow Left icon three times to return to the home screen.

If the parameters values are valid, the phone restarts to apply changes.


Configuring the media port range through the web interface

About this task

Use this procedure to configure the media port range through the web interface ofyour .

Procedure

Log in as administrator.Navigate to Media > Advanced.Set the First Media Port parameter.Set the Last Media Port parameter.Click Save.

If the parameters values are valid, the phone restarts to apply changes.



105

SIP SETTINGSThe Konftel 800 SIP settings include the following:

• Primary account• Secondary account• Fallback account• Source port• Transport protocol• Transport Layer Security (TLS)• Advanced SIP settings• DTMF• NAT Traversal

If you do not configure the SIP account for Konftel 800, the phone operates inUSB only user mode.


SIP account registration statusSIP account is a specifically configured set of credentials that provides access toSIP telephony and allows users to make calls from the phone. The SIP settings onKonftel 800 provide for configuring the primary account, the secondary account,and the fallback account.

If the phone has several configured SIP accounts, but there is only one registeredaccount, the phone displays the name of the registered account on its idle homescreen.

You can tell if the phone has a configured and registered SIP account or problemswith the SIP account registration by looking at its home screen. The followingoptions are available:

• The phone has no SIP account configured. Konftel 800 displays the phonename, the Bluetooth and Settings buttons on its idle home screen. The phonedoes not display the account name.

• The phone has the SIP account configured but not registered. For example,this can be due to invalid credentials of the SIP account or network problems.Konftel 800 displays the Warning icon, the account name, the Recent, Call,Unite, and Settings buttons on its idle home screen. When you tap the accountname or the Warning icon, the phone displays the following pop-up message:No sip service registered (Wrong username/password or


106

registrar?). It disappears automatically after a certain timeout, or you cantap Ok to return to the home screen.

• The phone has the SIP account configured and registered. The phone displaysthe phone name, the account name, the Recent, Call, Unite, and Settingsbuttons on the idle home screen.

You can use Konftel 800 via USB regardless of the SIP account registrationstatus. When the phone has no SIP account configured or registered, it acts as aspeakerphone that you can use to conduct virtual meetings and listen to audiofiles.


Caller information presentationKonftel 800 displays the calling person information to show who is calling ordisplay that the caller ID is unknown. This data is available on the Incoming Call,Active Call, and Recent Call List screens.

The phone shows the information that it receives from the caller's SIP invitemessage. It includes the following:

• CNAM: Usually specifies the contact name.• CID: Usually specifies the caller's phone number.

For example, when Konftel 800 receives the SIP invite message From: "JohnDoe" <sip:[email protected]>, John Doe is the CNAM and 1234 is theCID.

The following table lists the screen information, which Konftel 800 displays,depending on the parameters the server provides:

Screen Description

Incoming Call Konftel 800 displays the CNAM and the CID. If theserver does not provide the CID, the phone displays theCNAM.

If the server does not provide the CNAM or the CID, thephone displays Unknown.

Table continued…


107

Screen Description

Active Call Konftel 800 displays the CNAM. If the server does notprovide the CNAM, the phone displays the CID.

If the server does not provide the CNAM or the CID, thephone displays Unknown.

Recent Call List Konftel 800 displays the CID. If the server does notprovide the CID, the phone displays Unknown.


Configuring the Use Static Source Port settingAbout this task

Use this procedure to configure the Use Static Source Port setting through theweb interface or on the phone.

Procedure

• To configure the Use Static Source Port setting through the web interface, dothe following:

Log in as the administrator.On the web interface, navigate to SIP > Advanced.Enable Use Static Source Port.Optional: Disable Use Static Source Port.

• To configure the Use Static Source Port setting on the phone, do the following:Log in as the administrator.Tap SIP > Advanced.Enable Use Static Source Port.Optional: Disable Use Static Source Port.

When you change the Use Static Source Port value though the web interfaceor on the phone, the value in the configuration file changes accordingly.



108

Hostname to IP address mappingKonftel 800 supports hostname to IP address mapping to resolve configured IPaddress from hostnames. In case you do not have a DNS server configured, youcan manually map a hostname to the IP address using the configuration file.

You can configure host entities for the following services:

• NTP server• RTCP XR Collector URI• LDAP server• SIP Registrar• SIP Proxy• STUN server• TURN server• Konftel ZTI server• Provisioning server• SCEP server• Syslog server

If you use a Fully Qualified Domain Name (FQDN) in the SIP Registrar field forthe Primary, Secondary or Fallback SIP account, the SIP URI contains theconfigured FQDN instead of the IP address of the SIP Registrar.

If you plan to use a fictional SIP Registrar hostname, you must add it to theSIP server for its subsequent identification in SIP URI. SIP server checks if thereceived hostname from SIP URI matches the hostname configured on theserver. If the hostnames do not match, the SIP server rejects the configurationwith the following error code: code 403, Forbidden.

NETWORK SETTINGSThe network settings of Konftel 800 include the following:

• DHCP• Hostname• Domain• Static IP• DNS1• DNS2• VLAN• VLAN ID• LLDP


109

• 802.1x• SIP DiffServ• Media DiffServ

When you type in values (text-based input), do not use the followingcharacters: !@#$%^?/\-_.


LLDP Data UnitsWhen Konftel 800 uses LLDP, it sends the information as LLDP Data Units. EachLLDP Data Unit is a sequence of Time-Length-Value (TLV) strings.

The phone supports LLDP on primary Ethernet interfaces. The following table liststhe TLVs typical for Konftel 800:

Category TLV Name Stringlength

TLV String Value

BASICMANDATORY

CHASSIS ID 7 MAC ADDRESS OF THEPHONE

BASICMANDATORY

PORT ID 7 IP ADDRESS OF THE PHONE

BASICMANDATORY

TIME TO LIVE 2 LLDP_TTL

BASICOPTIONAL

SYSTEM NAME 22 LLDP_SYSTEM_NAME

BASICOPTIONAL

SYSTEMDESCRIPTION

28 VENDOR INFORMATION ANDFIRMWARE VERSION

BASICOPTIONAL

SYSTEMCAPABILITIES

4 THE PHONE IS WITHIN THESYSTEM CAPABILITIESOCTET. IF THE PHONE ISREGISTERED, BIT 5 THAT ISEQUAL TO THE PHONE ISWITHIN THE ENABLEDCAPABILITIES OCTET.


110


TLV String Value

BASICOPTIONAL

MANAGEMENTADDRESS

12 MGMT ADDR STRINGLENGTH = 5; MGMTADDRESS SUBTYPE = 01;(IPV4) MGMT ADDRESS =IPADD; INTERFACE NUMBERSUBTYPE = 2; INTERFACENUMBER = 3

ORGANIZATION SPECIFIC

IEEE - VLANNAME

11 OUC = 00-80-C2; IEEE 802.1SUBTYPE = 3; VLANIDENTIFIER = VLAN ID; VLANNAME LENGTH = LENGTHOF VLAN NAME; VLAN NAME= NAME OF VLAN


IEEE 802.3 -LINKAGGREGATION

9 OUC = 00-12-0F; IEEE 802.3SUBTYPE = LINKAGGREGATION 3;AGGREGATION STATUS = 1;AGGREGATED PORT ID = 0

ORGANIZATION SPECIFICIEEE 802.3

MAC/PHY/CONFIGURATION STATUS

9 802.3 OUC = 00-12-0F (HEX);802.3 SUBTYPE = 1;AUTONEGOTIATIONSUPPORT/ STATUS = VALUESENT DURING AUTO-NEGOTIATION; OPTIONALMAU TYPE = LLDP_MAU

TIA LLDP MED LLDP-MEDCAPABILITIES

7 TIA OUC = 00-12-BB (HEX);LLDP CAPABILITIESSUBTYPE = 1; LLDP-MEDCAPABILITIES = 00-3F (MEDCAPS, NETWORK POLICY,LOCATION ID, EXTENDEDPOWER, INVENTORY); LLDP-MED DEVICE TYPE = 3(CLASS III)


111


TLV String Value


CIVICLOCATIONIDENTIFICATION

63 TIA OUC = 00-12-BB;LOCATION DATA FORMAT =CIVIC ADDRESS LCI


ELINLOCATIONIDENTIFICATION

5 TIA OUC = 00-12-BB;LOCATION DATA FORMAT =ECS ELIN

TIA LLDP MED NETWORKPOLICY -VOICE

8 TIA OUC = 00-12-BB (HEX);NETWORK POLICYSUBTYPE = 2; APPLICATIONTYPE = 1 (VOICE) U = 0(NETWORK POLICY ISDEFINED) T = TAGGING X =0 (RESERVED BIT) VLAN ID =VLAN_IN_USE

TIA LLDP MED INVENTORY -SOFTWAREREVISION

5–36 TIA OUC = 00-12-BB (HEX);SOFTWARE REVISIONSUBTYPE = 7; SOFTWAREREVISION = VALUE


EXTENDEDPOWER-VIA-MDI

7 OUC = 00-12-BB; AVAILABLEPARAMETERS = POWERTYPE, POWER SOURCE,POWER PRIORITY, POWERVALUE

BASICMANDATORY

END-OF-LLDPU

0 NA



112

BLUETOOTH AND USB CONNECTION

BLUETOOTH® CONNECTIONKonftel 800 can establish wireless communication over Bluetooth® with devicesequipped with Bluetooth® connectivity, such as mobile phones, tablets, orcomputers. With Bluetooth®, you can use the phone as a speakerphone for callhandling, or as an audio receiver for audio streaming.

The following table lists the Bluetooth® technologies that Konftel 800 supports:

Bluetooth®technology

Konftel800 icon

Functionality

Bluetooth® LE To connect to a mobile device with KonftelUnite application installed on it. For moreinformation, see Konftel Unite on page 151.

This is the default mode.

Bluetooth® Classic To connect to Bluetooth® devices, such asmobile phones, tablets, and personalcomputers, for call handling or audiostreaming.

You cannot use Bluetooth® LE and Bluetooth® Classic connectionsimultaneously.

If you connect Konftel 800 to a Bluetooth® device, you cannot connect it to amobile device with the Konftel Unite application until you end the connection tothe Bluetooth® device.

If you connect Konftel 800 to a mobile device using the Konftel Uniteapplication, you cannot connect it to another Bluetooth® device until you endthe connection to Konftel Unite.

In USB only user mode, the phone supports connection to Bluetooth® devicesusing Bluetooth® Classic.

Switching between the Bluetooth® modes

The default mode is Bluetooth® LE. To switch to Bluetooth® Classic, you must pairand connect Konftel 800 to a Bluetooth® device. When you select Bluetooth®

113

Classic mode, the phone turns off Bluetooth® LE. If there is no Bluetooth® Classicconnection, the phone switches back to Bluetooth® LE after a timeout.

When you end a successful Bluetooth® Classic connection, Konftel 800 restoresBluetooth® LE mode.

Bluetooth® Classic profilesThe following table describes the Bluetooth® Classic profiles that Konftel 800supports:

Bluetooth®

profileKonftel 800role

Functionality description

Hands-FreeProfile (HFP)

Speakerphone When Konftel 800 is paired with a Bluetooth®

device and connected to it, the phone acts asa speakerphone. You can use the phone tohandle Bluetooth® calls. Konftel 800synchronizes the volume level with that of theBluetooth® device, and you can control thevolume from both devices.

AdvancedAudioDistributionProfile (A2DP)

Audio receiver When Konftel 800 is paired with a Bluetooth®

device and connected to it, Konftel 800 actsas an audio receiver. You can use the phoneto stream multimedia audio from theBluetooth® device.

The volume level of the streamed audio doesnot change. Konftel 800 keeps the volumelevel it had before it started playing audio.

When Konftel 800 is in Idle mode, and youstart A2DP streaming from the connectedBluetooth® device, the LEDs on the phoneremain turned off.

You cannot activate A2DP during SIP orUSB calls.

To use the Bluetooth® Classic functionality on Konftel 800, your Bluetooth®

device must support HFP or A2DP or both.


114

Pairing and connecting Bluetooth® devicesAbout this task

To enable Bluetooth® communication between Konftel 800 and another Bluetooth®

device, you must pair the two devices and ensure that they are in a connectedstate. The devices stay in a paired state until you remove the pairing.

You can connect only one device supporting Bluetooth® at a time.

Procedure

On the Konftel 800 screen, tap Settings > Bluetooth > Pair with device.

The LEDs start flashing blue, and the phone displays the following message:This phone is now discoverable as “<Phone Name>”.

The time-out value for discoverable mode is 120 seconds.

Tap Cancel to cancel pairing, for example, if you do not want to make thephone discoverable. In this case, you return to the Bluetooth menu.

On your Bluetooth® device, find Konftel 800 in the list of devices available forBluetooth® connection and tap the phone name.

Konftel 800 establishes the connection with the Bluetooth® device and displaysthe Bluetooth® icon and one of the following messages:

• If Konftel 800 retrieves the device name from your Bluetooth® device, itdisplays Connected to <your Bluetooth device name>. Forexample, Connected to My Smartphone.

• If Konftel 800 does not retrieve the device name from your Bluetooth®

device, it displays Connected to <your device Bluetoothaddress>. For example, Connected to 00:11:22:33:FF:EE.

Konftel 800 is not visible in the Konftel Unite application while theconference phone and the Bluetooth® device are in the connected state.


Removing Bluetooth® pairingAbout this task

Use this procedure to remove the pairing between Konftel 800 and your otherBluetooth® device to delete unwanted pairings.

also deletes the Bluetooth® pairing information when you reset the phone tofactory settings or perform system recovery.


115

Removing Bluetooth® pairing as described below does not affect Konftel Unitepairing information.

Before you begin

Ensure that Konftel 800 and the Bluetooth® device are in the paired state.

Procedure

Tap Settings > Bluetooth > Remove pairing.

The phone displays the following question: Do you want to remove allBluetooth pairing information from the phone?To confirm that you want to delete the Bluetooth® pairing information, tap Ok.

The phone restarts the application to apply the changes.

Related tasksLogging in to the web interface of Konftel 800 on page 30Setting the password for Konftel 800 on page 21

Connection between paired Bluetooth® devicesConnection

After you pair Konftel 800 and your Bluetooth® device, the two devices establishthe connection.

Disconnection

The connection ends if you manually disconnect Konftel 800 from the Bluetooth®

device or if the distance between the devices does not allow to maintain thecommunication.

When the Bluetooth® device ends the connection, Konftel 800 displays thefollowing message: Disconnected and then stops displaying the Bluetooth®

icon.

Reconnection

You can reconnect your Bluetooth® device to Konftel 800 if the two devices are ina paired state. You can reconnect Konftel 800 to the paired Bluetooth® devicefrom the paired Bluetooth® device.

Automatic reconnection to a Bluetooth deviceYou can use Konftel BT30 which is a Bluetooth USB dongle to connect yourKonftel One Cable Connect (OCC) Hub or computer to Konftel 800 . When the


116

conference phone loses power, it needs time to boot up. During this period, it hasno connection to the Bluetooth® device. When Konftel 800 enters Idle mode afterreboot, it automatically tries to reconnect to Konftel BT30 being the last pairedBluetooth® device. If the reconnection fails, Konftel 800 tries to reconnect in 30seconds. If the device does not respond, the phone stops the reconnectionattempts.

Bluetooth® radioKonftel 800 supports the Bluetooth® radio feature, which makes the device visibleto other Bluetooth® devices. By default, the Bluetooth® radio is in the enabledstate. The administrator can disable the Bluetooth® radio. When disabled,Bluetooth® LE and Bluetooth® Classic connection are not available on Konftel 800.

Related conceptsBluetooth® connection on page 113

Disabling Bluetooth® radioAbout this task

Use this procedure to disable Bluetooth® radio using the .xml configuration file.The default value is true, which means that the feature is enabled.

Before you begin

Obtain the .xml configuration file for Konftel 800.

Procedure

In the configuration file, go to the <bluetooth> section.Set the <enable> parameter to false.

<bluetooth> <enable type = "boo1">false</enable></bluetooth>

Save and import the configuration file.

The phone restarts the application.

Related conceptsBluetooth® connection on page 113Related tasksImporting the configuration file on page 123


117

USB ONLY USER MODEKonftel 800 supports USB only user mode. With this feature, the conferencephone can operate with no SIP account and SIP register configured. In USB onlyuser mode Konftel 800 acts as a speakerphone that the user can use to conductvirtual meetings and listen to audio files.

USB and Bluetooth® connection

In USB only user mode, the phone operates as a USB device connected to a USBhost.

In this mode, the phone supports connection to Bluetooth® devices usingBluetooth® Classic.

The administrator can use the configuration file to disable Bluetooth®. TheBluetooth button becomes inactive, and if the user taps it, the phone showsthe following message: Bluetooth is disabled by theadministrator.

When idle, Konftel 800 does not display Account Name on the home screen inUSB only user mode. The user can see the phone name and the connectionoption as follows:

• When the user connects the phone using USB, Konftel 800 indicates USBaudio on the home screen.

• When the user uses Bluetooth® to connect the phone, Konftel 800 indicatesBluetooth® audio on the home screen.

• When the user uses both Bluetooth® and USB for connection, Konftel 800indicates Bluetooth® audio on the home screen.

Related conceptsProvision of the NTP server address on page 98Firmware upgrade and downgrade on page 122

Time presentation in USB only user modeWhen the phone has NTP server settings enabled but it cannot connect to theNTP server in USB only user mode, Konftel 800 does not display time on thehome screen and in the settings menu.

When the phone has NTP server settings disabled, the user can set the timemanually. Then the options of the time presentation are the following:

• On the home screen when there is no active Bluetooth® or USB connection.• On the status bar when the user connects to Konftel 800 using Bluetooth® or

USB.


118

USB only user mode iconsThe following table shows the icons on the home screen of Konftel 800 in USBonly user mode:


USBConnected

To indicate an active USB connection.

The phone displays the USB Connected icon andshows USB audio on the idle home screen.

Bluetoothconnection

To configure Bluetooth® Classic settings and to indicatean active Bluetooth® Classic connection.

The phone shows the Bluetooth connection icon andBluetooth® audio indication on the idle homescreen.

If the administrator uses the .xml configuration fileto disable Bluetooth®, then the Bluetoothconnection icon is inactive.

Settings To check and configure the settings from the phone.View the phone status and reach the menu.

The following settings are available in USB only usermode:

• Status• Phone• Konftel Unite• Bluetooth• Admin Login

When Konftel 800 shows either the USB Connected or the Bluetoothconnection icon on the idle home screen, the phone displays time on thestatus bar.

Volume synchronizationWhen you connect Konftel 800 to the USB host and select it as an audio device,the phone synchronizes its volume level with the connected USB host.


119

Konftel 800 also synchronizes the volume level with the USB host when itswitches between Playback and Call mode. If you receive a call during audioplayback, the phone automatically changes the volume level for the call. Thephone synchronizes the volume with the USB host and applies the Call modevolume. When the call ends, the phone changes the volume back to the Playbackmode volume.

Konftel 800 supports volume synchronization if the USB host has Windows 10as its operating system.

You can adjust the volume level either on the phone or on the connected USBhost. When you set the maximum or the minimum volume level, the USB hostresponds as follows:

• If you decrease the phone volume to the lowest level, the volume on the USBhost turns off.

• If you increase the phone volume to the highest level, the volume on the USBhost changes to 100. This is the highest level for the USB host permitted.

Volume synchronization in Daisy chain mode

If you adjust the volume on the USB host for Konftel 800 acting as the main phonein a Daisy chain, the volume on the expansion phone changes accordingly. Theexpansion phone reflects the change showing the volume bar on the screen.

If you change the volume level on Konftel 800 acting as an expansion phone in aDaisy chain, the volume on the main phone and the USB host changesaccordingly.

If you turn the volume down to the lowest level, only the main phone displaysthe Volume Off icon.

Related conceptsExpansion of the phone coverage on page 156Related informationIcons on page 14

USB ports configurationYou can enable or disable the USB ports of your Konftel 800. When the USB portson the phone are enabled, you can use the USB audio port for audio transmissionand the USB upgrade port for a device upgrade.

To configure this parameter, you can insert the required value in the <usb> -<enable> section of the configuration file as follows:

• True to enable the USB ports. This is the default setting.


120

• False to disable the USB ports.

The power supply does not switch off when you disable the USB ports.


121

FIRMWARE UPGRADE AND DOWNGRADE

FIRMWARE UPGRADE AND DOWNGRADEStarting from Release 1.0.1, you can both upgrade and downgrade the firmware ofKonftel 800 using the web administration interface or a centralized file server. Thephone application installs the firmware whenever the firmware version in thedownloaded firmware file differs from the version of the currently running firmware.

You must select the file to upgrade the firmware on your device. The filenameends with .kt, for example, firmware-1.0.6.1.0-release.kt. With thefirmware selected, Konftel 800 immediately starts the installation process. Itperforms the firmware upgrade file validation to ensure absence of corrupted dataas well as that the firmware version is higher than the current one. If the firmwareversion is higher than the running version (it is an upgrade), the phone imports theconfiguration in full. Starting from Release 1.0.7, if the firmware version is olderthan the running version (it is a downgrade), Konftel 800 retains some of theconfigured parameters including the administrator password.

A downgrade to the firmware version lower than 1.0.1.0.2 causes a factoryreset and sets all user settings, configurations, and data to factory default.

Exporting the configuration fileAbout this task

Use this procedure to export the configuration file from your Konftel 800.

When you exporting the running configuration, the resulting .xml file contains thefollowing:

• All configured non-default values.• Lines with the commented out passwords.

Before you begin

Decide where the exported configuration file will be saved. By default, it is savedin the folder for downloaded files on your PC.

Procedure

On the web interface, click Provisioning.In the Configuration section, click Export Configuration button.

The web browser shows the configuration file.Save the page in an .xml format in the dedicated folder.

122

Optional: Edit the .xml file in a suitable application.

Editing the configuration fileAbout this task

Use this procedure to edit the exported configuration file.

Before you begin

To edit the configuration file, install a source-code editor that supports the importand export of .xml files. To verify the syntax and content of a .xml file, choose aneditor that also supports .xsd files.

Procedure

Open the configuration file using a suitable editor.Locate the parameter to change and type the required value.

For example, to specify the name of a SIP account, in the SIP section, locatethe <name type="string"></name> line and type the account name:<name type="string">Westview</name>.Optional: To add a comment, enter your text below the first line.

<?xml version="1.0" encoding="UTF-8"?> <KT800 version="6">

Click Save to save the modified file with the required file name.

To deploy the configuration file through a centralized management server,change the default file name to kt800.xml or kt800-<MAC>.xml.

Importing the configuration fileAbout this task

Use this procedure to import the previously saved configuration file to your Konftel800.

Procedure

On the web interface, click Provisioning.Go to the Configuration section.In Import Configuration, click the Choose file button.Locate the configuration file in the folder where it is stored.


123

Select the file in an .xml format and open it.

The name of the chosen file is near the Choose file button.Click Save.

The phone reboots or restarts to import the configuration if the configuration fileapplication requires this reboot or restart.

Uploading a firmware fileAbout this task

Upgrade or downgrade your Konftel 800 using a firmware file stored on the localhard disk. When the phone starts to install the firmware file you uploaded, itidentifies the firmware version and follows the upgrade or downgrade scenariobased on the firmware version.

Before you begin

Download the appropriate firmware file and save it in a specified location on yourpersonal computer.

Procedure

On the web interface, click Provisioning.In the Firmware section, click the Choose file button.Locate and select the downloaded firmware file.

The name of the chosen file is near the Choose file button.Click Save.

The system displays the upgrade in the browser window and on the screen ofKonftel 800.

Note that the phone must be in the idle state. If the phone is not in the idlestate, you see the following message on the web interface: Phone iscurrently in “Busy” state, please retry later.

Next steps

If DHCP is used in the network, the IP address might change. If the web browserloses contact with Konftel 800, check the IP address on the phone.

Related tasksViewing the IP address on page 29


124

Validation and migration of configurationStarting from Release 1.0.1, Konftel 800 validates and migrates the phoneconfiguration to ensure consistency of the configuration file with the firmwareversion. With this feature, the phone provides reliable automatic migration of theconfiguration file to match the newer firmware version if necessary.

Configuration validation

Konftel 800 validates compatibility of the configuration with the firmware againstan xml schema file based on the configuration file version.

Starting from Release 1.0.1, a configuration file has a version number attribute.The phone application compares the configuration file version to the firmwareversion running on the phone to determine the migration steps required to makethe configuration file consistent with the firmware.

All the configuration files that Konftel 800 generated before Release 1.0.1 acquirethe <KT800 version="0"> attribute in the xml root element. The configurationfiles generated with Release 1.0.1 acquire the <KT800 version="1"> attribute.With each new release, the configuration service increases the configuration fileversion number by one leaving the incompatible configuration changes attributedto previous file versions.

The phone does not support importing a configuration file from a newer versionof firmware. The .xml configuration file version must be the same or lower thanthe firmware version.

Firmware release XML file index No.

1.0.0 and Maintenance releases (MRs) 0

1.0.1 and MRs 1

1.0.2 2

1.0.3 3

1.0.4 4

1.0.5 5

1.0.6 6

Table continued…


125

1.0.7 7

To avoid failure of the configuration file import or automatic provisioning, ensurethat you do not change the version number in a configuration file manually.

Configuration migration

The migration feature ensures seamless import of the configuration data in thefollowing cases:

• During the phone boot• During the configuration file import using the web interface• During automatic provisioning of the phone using Device Management

Configuration import can fail if the configuration file does not match the .xmlschema file. In this case, you see the following message on the phone webinterface: Failed to migrate configuration file.

Firmware upgrade and downgrade using a USB mass storage deviceKonftel 800 uses the USB mass storage device to support firmware upgrade anddowngrade without the web interface. For that, the USB parameter must beenabled in the configuration file. If you have the USB parameter disabled, USB isinaccessible and unavailable for upgrade or downgrade.

When you connect the USB mass storage device to Konftel 800, the phone startsauto-mounting and finds the firmware file stored on the USB mass storage device.The auto-mounting and parsing process takes up to 30 seconds depending onyour flash drive.

Before performing upgrade or downgrade, the phone does not compare thefirmware version on the USB mass storage device and the currently used firmwareversion.

If the firmware file is invalid, the phone shows the following message: Invalidupgrade file.

The phone starts the upgrade or downgrade procedure immediately if it is inIdle Mode. Otherwise, Konftel 800 ends an active operation and then starts theupgrade process.

It is impossible to make calls or enter any menu on the phone during theupgrade.


126

Konftel 800 blocks the upgrade procedure using the USB mass storagedevice, if the phone already starts the upgrading procedure using the DeviceManagement provisioning server.

The phone supports several USB flash drive file systems including FAT32 andNTFS.

Konftel 800 supports only one partition USB flash drives for the upgrade.

If you set Admin Password in Settings > Phone, enter a valid administratorpassword before the phone starts the upgrade procedure.

You can upgrade or downgrade the out-of-the-box Konftel 800 during the initialboot if you connect the USB mass storage device to the phone and follow theupgrade procedure.

Upgrading firmware using a USB mass storage device without theadministrator passwordAbout this task

Use this procedure to upgrade or downgrade your Konftel 800 using a USB massstorage device if you have no administrator password set.

Before you begin

• Download the appropriate firmware file and save it in a specified location onyour personal computer.

• Upload the firmware file from your personal computer to the USB mass storagedevice root folder. The file name must be upgrade.kt.

• Make sure Konftel 800 is in Idle Mode.

Procedure

Connect the USB mass storage device to Konftel 800 USB port.

When checking for the appropriate firmware upgrade file, the phone shows thefollowing message: Checking upgrade file. Then the phone displays thefollowing message: Firmware version x.x.x.x.x found on USB.Upgrade now?, where x.x.x.x.x is the version of the valid firmware file.Tap Yes to proceed with the upgrade.

The phone starts the upgrade procedure, showing the following message:Upgrade in progress, please wait. When the upgrade procedureends, the phone reboots to apply the changes.Optional: Tap No to discontinue the upgrade.


127

If you tap No accidentally, to restart the procedure, reconnect a USB massstorage device to Konftel 800 USB port.

Related tasksUploading a firmware file on page 124

Upgrading the firmware using a USB mass storage device with theadministrator passwordAbout this task

Use this procedure to upgrade or downgrade your Konftel 800 using a USB massstorage device if you have an administrator password set.

Before you begin

• Download the appropriate firmware file and save it in a specified location onyour personal computer.

• Upload the firmware file from your personal computer to the USB mass storagedevice root folder. The file name must be upgrade.kt.

• Make sure Konftel 800 is in Idle Mode.

Procedure

Connect a USB mass storage device to Konftel 800 USB port.

While checking for the appropriate firmware upgrade file, the phone shows thefollowing message: Checking upgrade file. Then the phone displays thefollowing message: Firmware version x.x.x.x.x found on USB.Upgrade now?, where x.x.x.x.x is the version of the valid firmware file.Tap Yes to proceed with the upgrade.

The phone displays the Admin Password popup.In the Admin Password field, type the administrator password.Optional: If you enter an incorrect administrator password, the phone displaysthe following message: Invalid password. Do the following:

Tap Ok.Type the correct administrator password.

Tap Upgrade.

The phone starts the upgrade procedure, showing the following message:Upgrade in progress, please wait. When the upgrade procedureends, the phone reboots to apply the changes.Optional: Tap Cancel to discontinue.


128

If you tap Cancel accidentally, to restart the procedure, reconnect a USB massstorage device to Konftel 800 USB port.

Related tasksUploading a firmware file on page 124

Configuration retention after downgradeWhen you downgrade the firmware of your Konftel 800, the phone retains some ofthe configured parameters. The phone keeps configuration for the following:

• DHCP• Static IP Address• Static IP Gateway• Static IP Network mask• DNS• VLAN• Administrator password• Provisioning address• Provisioning certificates• NTP

The phone does not save the configured parameters if you downgrade thefirmware to a version lower than 1.0.1.0.2. The downgrade causes a factoryreset and sets all user settings, configurations, and data to factory default.

Device ManagementKonftel 800 provides the Device Management feature to facilitate upgrade andconfiguration of multiple conference phones. When enabled and configuredcorrectly, Device Management obtains firmware and configuration automatically bypolling the centralized server on a defined basis. This server is called theprovisioning server. The service provider is in charge of uploading the necessaryfiles to the provisioning server.

The device controls the configuration and firmware download with a frequency of 1hour.

Configure the Device Management feature in line with the description inConfiguration parameters on page 35. By default, Device Management is enabled.

Files on the provisioning server

The following files must be available on the provisioning server:

• Firmware file (filename ends in .kt)


129

• Firmware metadata file (as provided in the Konftel Firmware bundle)• Global configuration file• Device-specific configuration file (optional)• Global certificate configuration file• Device-specific certificate configuration file (optional)

Configuration priorities

The following table describes the priorities for files downloaded to the phoneduring the Device Management configuration upgrade:

File type Description

Global configurationfile

If available, the device obtains the global configurationfile kt800.xml and parses it. During the DeviceManagement update all parameters from the file areloaded into the Konftel 800 running configuration.

Device-specificconfiguration file

If the device-specific configuration file kt800-<MAC>.xml is available on the provisioning server, thephone downloads and parses it. The parameters fromthis file overwrite the parameters set by the globalconfiguration file.

Global certificateconfiguration file

If available, the device obtains the global certificateconfiguration file and uses it for its operations.

The certificates the phone downloads from theprovisioning server overwrite any certificates youdownloaded manually using the phone web interface.

Device-specificcertificateconfiguration file

The device-specific certificate configuration file haspriority over the global certificate configuration file. Allits parameters overwrite the parameters loaded by theglobal certificate configuration file.

After Konftel 800 obtains the configuration from the provisioning server, parsesit, adds and saves the parameters in a local configuration file, all changes youmake using the web interface or the phone UI replace the parameters storedas the current running configuration. To clear a manually set parameter, theadministrator must first provide a configuration file with the parameter havingno value assigned to it, and then push a configuration that contains the newparameter.


130

Konftel Zero Touch Installation

Zero Touch Installation (ZTI) is an add-in for automatic provisioning that Konftel800 supports. It provides for the remote configuration of the phone by using a datafile with settings. The phone downloads the file from a Device Management server.The user can apply ZTI when centrally upgrading the phone software.

Related conceptsCertificates on page 135Konftel 800 .xml configuration files on page 24

Registration with the ZTI device management serviceAbout this task

Use this procedure to register the phone with the device management service andreceive the provisioning settings.

Before you begin

Connect the phone to the data network and start it.

Procedure

In the web browser, enter https://www.konftel.com/zti-access.Register the phone with Konftel ZTI by entering its MAC address and serialnumber.

The device management service provides the phone with the address of theprovisioning server where the user can download the configuration file in .xmlformat.Confirm your choice.

The phone restarts and goes to the appropriate server to download theconfiguration file.

Upgrading multiple devicesAbout this task

You can upgrade firmware on multiple Konftel 800 devices using DeviceManagement instead of upgrading each phone individually. For this purpose,Device Management must be enabled for the devices, the provisioning servermust be specified for the devices, and the firmware binary file and the firmwaremetadata file must be available on the provisioning server.

Note that you must have separate kt800-<MAC>.xml configuration files for eachKonftel 800. Here, <MAC> is the MAC address of a specific phone.


131

https://www.konftel.com/zti-access

Before you begin

Ensure that the firmware filename matches the <filename> value in themetadata file, and that the firmware version in both files is the same.

Procedure

Check if Device Management is enabled on the phones you want to upgradeand enable if necessary.

You can do this on the phone by logging in as an administrator and navigatingto Settings > Device Management or through the web interface on theProvisioning tab in the Device Management section.Check if the provisioning server is configured for the phones you want toupgrade and configure if necessary.

You can do this on the phone by logging in as an administrator and navigatingto Settings > Device Management or through the web interface on theProvisioning tab in the Device Management section.Upload the binary file and the firmware metadata file to the provisioning server.

When the phones contact the provisioning server, the upgrade process starts.

Next steps

You can check the firmware version from the phone by navigating to Settings >Status or through the web interface in the Status tab.

Configuring multiple devicesAbout this task

You can configure multiple Konftel 800 devices using the configuration file as amanagement tool instead of configuring the settings on each phone individually.For this purpose, you need to export the configuration file, edit the settings asnecessary, and then place the configuration file to the provisioning server.

Before you begin

Ensure that you or the service provider have configured the provisioning server foryour phones.

Procedure

Log in to the web interface.Export the configuration file by clicking Export Configuration on theProvisioning tab.

The phone generates the global configuration kt800.xml file.


132

Optional: Edit the configuration file using a suitable application.

The settings file might not contain some settings if they represent a defaultvalue. To include such settings in the configuration file, you need to changethem to a non-default value using the phone interface or the web interface.

Upload the file to the provisioning server.

During the next Device Management configuration upgrade, the system appliesthe configuration file to the phones. After the phones reboot, they all have thesame settings specified in the configuration file.

Related conceptsDevice Management on page 129


133

SECURITY AND PROTECTION

SECURITY METHODS AND PROTOCOLSKonftel 800 supports a number of security methods and protocols to protect theintegrity of its configuration and operation.

802.1X Ethernet Authentication

With 802.1X Ethernet authentication enabled, Konftel 800 must authenticate as arecognized device before getting an authorization to communicate on the network.

You can secure the 802.1X Ethernet authentication process by configuring one ofthe following options:

• EAP TLS. The device uses the applicable TLS version to communicate with the802/1X authentication server. You can manually install TLS certificates can onKonftel 800 by using the web administration interface or the certificates .xmlfile.

• EAP MD5. The device uses the MD5 method to communicate with the 802/1Xauthentication server. You must enable Legacy Encryption to use EAP MD5.

It is possible to configure both TLS and MD5, and then the authentication server(RADIUS server) selects the protocol to use.

FIPS

Enabling the Federal Information Processing Standards (FIPS) results in the useof an enhanced suite of encryption algorithms as well as supporting timers andprocesses to meet the FIPS 140-2 requirements. With FIPS enabled, you can nothave the Legacy Encryption methods enabled at the same time.

TLS

The device uses Transport Layer Security (TLS) protocols for SIP authentication,HTTPS connectivity for the centralized file server, and LDAP authentication andcommunication. The following TLS protocols are available:

• SIP-TLS to secure the communications with the SIP Registrar.• LDAP-TLS to secure the communications with the LDAP server. The device

uses this protocol by default.

You can manually install TLS certificates can on Konftel 800 by using the webadministration interface or the certificates .xml file.

134

CERTIFICATESThere are several factory-installed security certificates on the Konftel 800. You caninstall additional certificates through the centralized configuration server, , SCEPor manually through the web interface.

Pre-installed certificates

Konftel 800 has a factory-installed device specific private key. You cannot view ordelete this private certificate.

Installable certificates

Certificate configuration files stored on the provisioning server allow you toautomatically download certificate files to Konftel 800. These files are required forthe server validation by the phone and TLS authentication by the server.

The service provider can upload a global certificate configuration file and a device-specific certificate configuration file.

The default name for the global configuration file is kt800_certcfg.xml. Thedefault name for the global configuration file is kt800_certcfg-<MAC>.xml,where <MAC> is the MAC address of the specific phone.

Instead of the .xml file format, the service provider can also use cgi, php, asp, js,or jsp file formats. Konftel 800 first searches for the configuration file in .xmlformat. If the phone fails to find the .xml file on the provisioning server, it searchesfor the configuration file in other formats specified above.

The typical certificate configuration file consists of four sections:

• 802.1x: specifies the 802.1x certification arrangements of the phone.• SIP: contains the Session Initiation Protocol (SIP) certification arrangements of

the phone.• Provisioning: runs through the provisioning server certification arrangements of

the phone.• LDAP: specifies the LDAP server certificate arrangements of the phone.

There is no requirement to populate all four sections in the .xml file. Insert thedata only to the sections used.

Each section includes the following certificate files:

• CA certificate• Device certificate• Device private key.

Each section contains the path details for the CA certificate, Device certificate, andDevice private key.


135

The path to the certificate can be a relative path or a complete URI. Forexample, a relative path can look like <ca_uri>ca.crt</ca_uri> or<ca_uri>сerts/ca.crt</ca_uri>. In the first case, the phone looks forthe ca.crt file in the same catalog as the configuration file. In the secondcase, the phone looks for the ca.crt file in the certs catalog relative to theconfiguration file.

The file can have the path to the certificate in the form of a complete URI, like<ca_uri>https://hostname.io/path/ca.crt</ca_uri>. In this case,the phone uses a specific URI to download the certification file.

The section also specifies a SHA256 or an MD5 checksum for each element in it.This checksum (also called SHA256 hash algorithm or MD5 hash algorithm) is atype of digests of the specified certificates.

Konftel 800 uses MD5 checksum only when Allow Legacy Encryption isenabled. In this case, both SHA256 and MD5 hash algorithms are supported.When Allow Legacy Encryption is disabled, Konftel 800 supports onlySHA256 hash algorithm. Then the phone does not use MD5 as the checksumfor certificates if it downloads and stores them during provisioning.

When you have the Device Management enabled or after the restart, the phonestarts downloading the certificate if the hash algorithm value is different from theone of the certificate file that Konftel 800 stores. That means that the phonedownloads one certificate file only once and subsequently checks that thecertificate file is still the same.

Related conceptsLegacy encryption mode on page 144

Certificate configuration file structureThe following table shows the format of the certificate file:

String Description

<certificates> To specify the certificates that the phone applies.

<ether_8021x> To specify the 802.1x certification arrangements of thephone.

<ca_uri> To specify the 802.1x path to check the CA certificate.

Table continued…


136

String Description

<ca_hashalgo="SHA256">

To specify the SHA256 hash algorithm that the phoneuses to verify the 802.1x CA certificate.

<cert_uri> To specify the 802.1x path to get the device certificate.

<cert_hashalgo="SHA256">

To specify the SHA256 hash algorithm that the phoneuses to verify the 802.1x device certificate.

<privkey_uri> To specify the 802.1x path to get the private key.

<privkey_hashalgo="SHA256">

To specify the SHA256 hash algorithm that the phoneuses to verify the 802.1x private key.

<sip> To specify the SIP certification arrangements of thephone.

<ca_uri> To specify the path to get the CA certificate for the SIPconnection.


To specify the SHA256 hash algorithm that the phoneuses to verify the CA certificate for the SIP connection.

<cert_uri> To specify the path to get the device certificate for theSIP connection.


To specify the SHA256 hash algorithm that the phoneuses to verify the device certificate for the SIPconnection.

<privkey_uri> To specify the path to get the private key for the SIPconnection.


To specify the SHA256 hash algorithm that the phoneuses to verify the private key for the SIP connection.

<provisioning> To specify the provisioning server certificationarrangements of the phone.

Table continued…


137

String Description

<ca_uri> To specify the path to get the CA certificate forconnection to the provisioning server.


To specify the SHA256 hash algorithm that the phoneuses to verify the CA certificate for connection to theprovisioning server.

<cert_uri> To specify the path to get the device certificate forconnection to the provisioning server.


To specify the SHA256 hash algorithm that the phoneuses to verify the device certificate for connection to theprovisioning server.

<privkey_uri> To specify the path to get the private key for connectionto the provisioning server.


To specify the SHA256 hash algorithm that the phoneuses to verify the private key for connection to theprovisioning server.

<ldap> To specify the LDAP server certificate arrangements ofthe phone.

<ca_uri> To specify the path to get the CA certificate forconnection to the LDAP server.


To specify the SHA256 hash algorithm that the phoneuses to verify the CA certificate for connection to theLDAP server.

<cert_uri> To specify the path to get the device certificate forconnection to the LDAP server.


To specify the SHA256 hash algorithm that the phoneuses to verify the device certificate for connection to theLDAP server.

Table continued…


138

String Description

<privkey_uri> To specify the path to get the private key for connectionto the LDAP server.


To specify the SHA256 hash algorithm that the phoneuses to verify the private key for connection to theLDAP server.

The following is an example of the certificate configuration file for Konftel 800.Note that it contains only 2 out of 4 sections.

<certificates> <ether_8021x> <ca_uri>8021x_ca.crt</ca_uri> <ca_hash algo="SHA256">c49d8fd0cbb6bfc26ef752296d6d17f7</ca_hash> <cert_uri>8021x_dev.crt</cert_uri> <cert_hash algo="SHA256">ca059972d02b2853a92704a7a7640f3f</cert_hash> <privkey_uri>8021x_priv.key</privkey_uri> <privkey_hash algo="SHA256">f4728d6356204c6fcce91989ef733553</privkey_hash> </ether_8021x> <provisioning> <ca_uri>prov_ca.crt</ca_uri> <ca_hash algo="SHA256">e5116932d3685ea18ead10a55b825145</ca_hash> </provisioning> </certificates>

With Allow Legacy Encryption enabled, the certificate configuration file cancontain MD5 and SHA256. If you disable Allow Legacy Encryption, then onlythe SHA256 hash algorithm is supported.

Related conceptsLegacy encryption mode on page 144

Certificates applicationUse certificates to authenticate Konftel 800 using TLS. You can apply certificatesmanually when configuring the advanced settings of your phone, or the phone can


139

automatically download the certificates from the provisioning server if you enabledDevice Management.

The application of a certificate involves the following:

• Download of the root certificate from the Certificate Server• Creation of the server certificate from the Certificate Server• Generation of the private key• Conversion of the certificates and the private key to .PEM format• Import of the .PEM files to the phone

Related conceptsCertificates on page 135

Downloading the root certificate

About this task

The administrator must obtain a root certificate from a Certificate Authority (CA).This CA certificate has the key size of 2048, is in PKCS10 format and is generatedusing SHA-1 hash algorithm.

Use this procedure to download the Microsoft generated root certificate that thephone will apply for authentication by using TLS/SIPS and EAP-TLS.

Before you begin

Connect to Microsoft Server Certification Authority.

Procedure

On the Microsoft Server Certification Authority page, click Download a CAcertificate, certificate chain, or CRL.Click Download CA certificate.

Installing the certificate

About this task

Use this procedure to install the certificate that the phone will apply forauthentication using TLS/SIPS and EAP-TLS. You can do it from your regular webbrowser. The following is the procedure for Google Chrome. For information aboutother web browser applications, see the instructions provided by the softwaremanufacturers.

Before you begin

Open your web browser.


140

Procedure

Click Settings > Advanced > Privacy and security > Manage certificates.In the Certificates window, click Import.In the Certificate Export Wizard window, click Next to proceed.Specify the file you want to import and click Next.Choose the key store for the certificate and click NextClick Finish.

Exporting the private key

About this task

Use this procedure to export the private key that the phone will apply forauthentication using TLS/SIPS and EAP-TLS. You can use your regular webbrowser. The following is the procedure for Google Chrome. For information aboutother web browser applications, see the instructions provided by the softwaremanufacturers.

Before you begin

Open your web browser.

Procedure

Click Settings > Advanced > Privacy and security > Manage certificates.In the Certificates window, select the certificate to export and click Export.In the Certificate Export Wizard window, click Next to proceed.Click Yes to export the private key.Select the format in which you want to export the private key file and click Next.Specify the file name, choose the location to export the certificate, and clickNext.Click Finish.

Converting the certificates to .PEM format

About this task

Use this procedure to convert the certificates for the phone to .PEM format.Konftel 800 supports certificates in the .PEM format only.

Before you begin

Ensure that you have OpenSSL installed on your computer. If you don't have it,you can download this toolkit from the OpenSSL Project web page and install onWindows OS or MAC OS.


141

http://www.openssl.org/

Procedure

Run OpenSSL.Use the following Openssl commands to convert the files:

From .DER to .PEM:

openssl x509 -inform der -in certificate.cer -out certificate.pemFrom .PFX to .PEM:

openssl pkcs12 -in certificate.pfx -out certificate.cer -nodesOn the web interface, browse to the .PEM files to use TLS mode ofauthentication.

STANDARD ENCRYPTION ALGORITHMSKonftel 800 uses encryption algorithms that comply with the current industrystandards. Currently, the phone supports the data integrity algorithms with nopublicly known vulnerabilities and are the US National Institute of Standards andTechnology approved.

Standard encryption algorithms for the external connections to the system (forexample, TLS) include the following:

• Symmetric Encryption:

• AES 256 (required)• AES 192 and AES 128 (optional)

• Asymmetric Encryption:

• RSA: 2048 (required) and 4096 (optional)• DH: 2048 (required) and 4096 (optional)• ECC: secp384r1 and secp256r1 (required)

• Hash Algorithms:

• SHA2 (required)• SHA3 (optional)

• Hashed Message Authentication Code:

• HMAC-SHA2 (required)• HMAC-SHA1 (used for integrity and routing)

Konftel 800 provides support to specific FIPS-related encryption algorithms, whichmakes it ready for operation in FIPS mode.


142

When you need legacy or non-standard encryption algorithms for the externalconnections, you can use Legacy encryption mode. In this case the phone workswith the encryption algorithms applied before R.1.0.4.

Standard encryption application areas:

• Web pages for administration• SIP with TLS• Device management to HTTPS server• LDAP with TLS• Media encryption with SRTP• 802.1x

Related informationEncryption methods in Legacy encryption mode on page 177

Standard encryption for 802.1xYou can configure Konftel 800 to allow 802.1x authentication to use EAP MD5method.

If you need to use EAP MD5 method for 802.1x, ensure that you set the AllowLegacy Encryption option to true and FIPS Mode to false. When you try to enableEAP MD5 while Allow Legacy Encryption is disabled, the phone warns you withthe following message: EAP MD5 requires Allow Legacy Encryption tobe enabled. When you try to enable Allow Legacy Encryption while FIPS Modeis enabled, the phone warns you with the following message: Allow LegacyEncryption cannot be enabled while FIPS mode is enabled.

You can configure Konftel 800 to allow 802.1x authentication to use EAP MD5method on the phone, through the web interface, or using a configuration file.

When you upgrade the phone from a version without the legacy encryption optionand enable EAP MD5 method, the phone automatically enables the Allow LegacyEncryption option.

When you import a configuration file, the phone settings update in line with theimported configuration file. If the value of <eap_md5> is set to true, you mustalso set the value of <allow_legacy_encryption> to true.

Related tasksImporting the configuration file on page 123Related informationConfiguration parameters on page 35


143

Standard encryption for media encryption with SRTPWhen the key exchange for media encryption with SRTP occurs, Konftel 800supports the AES_256_CM_HMAC_SHA1_80 mandatory crypto.

Some servers do not support this mandatory crypto. In this case you must enablethe Allow Legacy Encryption option to make an SRTP call. By default, it isdisabled.

In case you enable the Capability Negotiation setting for the phone to negotiatetransport protocols and attributes, the phone supports one crypto only. Thesupported crypto depends on the Legacy encryption mode configuration asfollows:

• If you disable the Legacy encryption mode, the phone offersAES_256_CM_HMAC_SHA1_80 crypto only.

• If you enable the Legacy encryption mode, the phone offersAES_CM_128_HMAC_SHA1_80 crypto only.

When you disable the Capability Negotiation setting, there are several cryptosolutions available for the SRTP negotiation. The options are the following:

• With the Allow Legacy Encryptionsetting disabled, the phone supports theAES_CM_128_HMAC_SHA1_80 and AES_256_CM_HMAC_SHA1_80 cryptos.

• With the Allow Legacy Encryption setting enabled, the phone supports theAES_CM_128_HMAC_SHA1_80 and AES_256_CM_HMAC_SHA1_80 cryptos.

In the configuration file the configured parameters are <capneg> and<allow_legacy_encryption>

Legacy encryption modeKonftel 800 also supports specific legacy encryption algorithms. If you enableLegacy encryption mode, the phone offers all the previously supported ciphers forthe SSL negotiation and cryptos for SRTP. You can check the offered ciphersusing a specialized network protocol analyzer. At that, the phone supports thelegacy encryption algorithms only for backward compatibility.

By default, Legacy encryption is enabled.

Firmware upgrade

When you upgrade Konftel 800 from a version without the legacy encryptionoption, the phone automatically enables the Allow Legacy Encryption option.When you reset Konftel 800 to the factory default state, the phone also enablesthe Allow Legacy Encryption option.


144

When upgrading, the phone automatically enables the Allow Legacy Encryptionoption, if 802.1x with EAP MD5 is enabled.

Related informationEncryption methods in Legacy encryption mode on page 177

FIPS MODEKonftel 800 supports a specific FIPS mode to make the encryption andcryptographic functions compliant with Federal Information Processing Standards(FIPS). When you enable FIPS mode, the phone employs approved key exchangealgorithms, cryptographic algorithms, and authentication techniques to meet theFIPS 140-2 requirements.

When Konftel 800 needs cryptographically secure numbers, it uses randomnumber generator functions from FIPS 140-x compliant cryptographic libraries. Aspecific FIPS-approved random number generator renders cryptographic numberinitialization vectors.

With FIPS mode enabled, the device management with HTTPS server occursusing the SSL encryption method.

By default, FIPS mode is disabled.

If you configure the phone to allow legacy encryption, you cannot enable FIPSmode. You see the following popup message: FIPS mode cannot beenabled while Allow Legacy Encryption is enabled.If you configure the phone to use 802.1x with EAP MD5, you cannot enableFIPS mode. The phone warns you with the following message: FIPS modecannot be enabled while 802.1x with EAP MD5 is enabled.

Related conceptsStandard encryption for 802.1x on page 143Legacy encryption mode on page 144

FIPS mode for media encryption with SRTPWhen the key exchange for media encryption with SRTP occurs with FIPS modeenabled, Konftel 800 supports one mandatory cryptoAES_256_CM_HMAC_SHA1_80.

The conference phone supports the same mandatory cryptoAES_256_CM_HMAC_SHA1_80 when FIPS Mode and Allow Legacy Encryptionare disabled.


145

When the administrator disables FIPS Mode and enables Allow LegacyEncryption, Konftel 800 supports AES_CM_128_HMAC_SHA1_80 for mediaencryption with SRTP.

SCEP SUPPORTKonftel 800 supports Simple Certificate Enrollment Protocol (SCEP) required formanaging digital certificate obtainment. SCEP is used to contact a SCEP server toget an Identity certificate. The device uses this certificate for all TLS connections ifthey do not have manually configured certificates (SIP TLS, 802.1x EAP-TLS,Provisioning via TLS, LDAP). You can also obtain a CA certificate if the SCEPserver has corresponding configurations.

SCEP enrollment

You can configure SCEP through the web interface and importing theconfiguration file with the specific SCEP settings. After Konftel 800 reboots, itattempts to connect the specified SCEP server. If the server is reachable, itprovides the certificates with the settings matching the server configuration. If thereceived certificate is valid and the SCEP enrollment is successful, the phonesaves the configuration and reboots.

When the device requests an SCEP server to get or renew a certificate, therequest must be approved. The following types of request approval are available:

• Manual approval. The SCEP server receives your request, and then the SCEPserver administrator must approve it. The next request of the device results inthe certificate provision.

• Automatic approval. The SCEP server checks your request for validity, then ifthe parameters are accurate, approves the request and sends you thecertificate.

The enrollment fails if the settings configuration on the phone and the server donot match. Here, Konftel 800 triggers the next enrollment in 24 hours.

If you upload a certificate to the phone through the web interface or usingautomatic provisioning only for one connection, for example, for the LDAPconnection, that connection continues to use the configured certificate. Otherconnections use the SCEP Identity certificate received from the SCEP server.

Mandatory SCEP parameters

Successful enrollment is only possible if you configure the relevant SCEP serverand valid SCEP settings. When you enter the URL of the dedicated SCEP server,you must specify the following parameters:

• Common Name


146

• CA Identifier• Initiate renewal on % of Validity interval• Key Length• Password

There is no check of mandatory parameters in automatic provisioning andconfiguration file import. You must always provide valid data.

Background polling

If you configure SCEP with the valid data, the phone attempts to connect to theSCEP server. If the server is reachable, it immediately starts processing theenrollment or renewal request. If the connection fails, Konftel 800 attempts tocontact the SCEP server in the background.

For manual approval of a certificate, the phone sends the first request after thereboot and repeats it 20 times within 300 seconds. If the request staysunapproved, the phone tries to connect again in 24 hours.

Auto-renewalThe SCEP server provides a device certificate with a specified validity period,meaning that the device certificate expires in a pre-set amount of days. After itexpires, you must get a new device certificate from the SCEP server. You canconfigure the date and time to send the renewal request for the certificate. Youmust specify the renewal date and time in percent of the expired validity period ofthe valid certificate. For example, you can configure to send the renewal requestwhen the current certificate validity period expires by 95%. You must enter 95 inthe Initiate renewal on % of Validity Interval field.

When the auto-renewal of the certificates is complete, the phone reboots as soonas it enters Idle mode. After the reboot, Konftel 800 starts using the new devicecertificate.

The phone can also boot up with an expired certificate. If you have the renewalrequest parameter configured, the phone sends the renewal request after thephone boots up.

Configuring SCEP renewal requestAbout this task

When Konftel 800 receives a device certificate from a SCEP server, the certificatehas a specified validity period, after which the certificate expires. Use thisprocedure to configure a SCEP renewal request through the web interface.


147

Before you begin

Log in to the web interface as the administrator.

Procedure

On the web interface, click Provisioning.In the SCEP section, enter the value in Initiate renewal on % of ValidityInterval.

The value range is from 1 to 99. The default value is 90.Click Save.


The web interface shows Save Succeeded pop-up message.

Related conceptsSCEP support on page 146

Provisioning of the CA certificate through SCEPThe SCEP server supports the provisioning of CA certificates, which Konftel 800uses as the default CA certificates for all TLS connections.

If any of the TLS connections requires a specific CA certificate, you can do thefollowing:

• Install the certificate manually. Here, the phone uses the manually installed CAcertificate and ignores the certificate received from the SCEP server.

• Request and receive the certificate from the SCEP server.

If you have a CA certificate from the SCEP server and initiate the SCEP renewenrollment process, the phone continues using this CA certificate after the SCEPrenew enrollment process ends.

Related conceptsCertificates on page 135

WEB INTERFACE SETTINGSThe web server in Konftel 800 supports secure connections using HTTPS. Youcan configure this parameter only through the web interface.

The phone supports connection to the web interface only through https.


148

The following table shows the web interface settings that you can configure forKonftel 800 in the Provisioning tab:

Name Description

Secure HTTP

Webapp HTTPsCertificate

To upload a .PEM certificate to Konftel 800 to use HTTPS.

Konftel 800 supports certificates in the .PEM formatonly. You must convert the certificates and private keysto .PEM before using in the phone. For moreinformation, see Converting the certificates to .PEMformat on page 141

You can use the following command to generate a HTTPS web interfacecertificate:

openssl req –new –x509 –keyout https _ web _ certificate.pem –out https _ web _ certificate.pem –day <number of days>-nodes

DISABLING WEB ACCESSAbout this task

Use this procedure to disable the web access setting of your Konftel 800 forsecurity reasons. By default, web access is enabled.

After you disable this setting, you cannot access your phone through the webinterface. You can restore access to the web interface by enabling the web accesssetting on the phone or through auto-provisioning.

Before you begin

Ensure that you have the administrator password configured on the phone.

Obtain the .xml configuration file.

Procedure

• To disable web access on the phone, do the following:Log in as the administrator.On the phone screen tap Settings > Admin > Device Management.Disable Web Access.Tap the Arrow Left icon twice to return to the home screen.


149

The phone reboots to apply the changes.• To disable web access through the web interface, do the following:

Log in to the web interface.Click Provisioning.In the Device Management section, disable Web Access.

You can see the following warning message: You will not be ableto access phone administration web interface afterdisabling Web Access.Click Save.

• To disable web access by using the .xml configuration file, do the following:Locate the <httpd> section in the configuration file.In the <enable> line, change the value to false.Save the file.Import the configuration file through the web interface.


PROTECTION AGAINST CROSS-SITE REQUESTFORGERYWhen the user logs in to the web interface of Konftel 800 with the administratorpassword, the web application of the phone uses specific tokens to protect againstCross-Site Request Forgery (CSRF) attacks.

CSRF is an attack that tricks the user into submitting a malicious request. Theattacker takes the identity and privileges of the user to make undesired actions onthe user’s behalf. CSRF attacks target functionality that causes a state change, forexample changing the user's password. If the user stays authenticated to thewebsite during the attack, the website can not distinguish between forged andlegitimate requests.

Konftel 800 generates a new CSRF token on each request. Each link or parameterchange in the web interface needs to have a CSRF token as a request parameter.The web application checks if the token in the request is the correct one. Forexample, if the attacker copies an existing link from the open web interface ofKonftel 800, the server responds with the following error code: HTTP statuscode 403, forbidden.

You are recommended to administer the settings in the web UI only from onecomputer and one browser simultaneously. This way you can minimize the riskof getting the error code message due to incorrect token use.


150

CALLS HANDLING APPLICATION

KONFTEL UNITEYou can manage your Konftel 800 from a mobile phone or a tablet if you haveKonftel Unite installed on the device. Download and install Konftel Unite free fromApp Store and Google Play like any other application. Use the NFC tag to easilystart downloading the application. For that, you must bring the mobile device withthe NFC enabled to the NFC tag on the conference phone, and the web browseron the mobile device opens the web page with the application in App Store orGoogle Play.

With Konftel Unite, you can call contacts from your local address book, createconference groups, and control a call. For example, answer and hang up the call,mute and unmute the microphone, dial a number, adjust the volume level, andhold and resume the call.

The mobile device with Konftel Unite is connected to the phone over the built-inBluetooth® LE. Konftel 800 is always discoverable for this connection.

Starting from R 1.0.4, Konftel 800 uses SHA256 method for challenge-responseauthentication to connect to Konftel Unite.

If your conference phone fails to connect to Konftel Unite, you must downloada newer version of the application from App Store or Google Play. It works bothwith R 1.0.4 and earlier released firmware.

Configure Konftel Unite parameters on the phone and from the mobile device withthe application installed.

Pairing and connecting devicesAbout this task

Use this procedure to pair your Konftel 800 with Konftel Unite on your mobiledevice the first time when you use them together. After that, they connect with onetouch when you run the application near the conference phone.

The connection range is up to 20 meters. The connection breaks if this range isexceeded. You see a request to reconnect when Konftel Unite is within the rangeof Konftel 800. Reconnection requires only one touch.

You can pair up to 100 mobile phones or tablets with your Konftel 800. But onlyone user connection is active at a time.

151

Procedure

On your mobile device, open Konftel Unite.

The mobile phone displays the closest Konftel 800.To select the phone you want to connect, perform one of the following actions:

• If your mobile device displays Konftel 800 you want to connect, tapConnect on the mobile device screen.

• If your mobile device does not display Konftel 800 you want to connect, tapSkip and then tap the connection symbol in the upper left corner of yourmobile device screen.

The mobile device displays the list of available conference phones.

The mobile phone displays a pairing code for about 30 seconds.Enter the code with the keypad on the conference phone.Tap Enter on the conference phone to start pairing.

When the devices are paired, both Konftel Unite and Konftel 800 display theconnection symbol.

The conference phone and Konftel Unite remain paired while they are close toone another.

You cannot connect Konftel 800 to a Bluetooth® device for call handling oraudio streaming while the Konftel Unite connection is active.

Disconnecting devicesAbout this task

Use this procedure to disconnect your Konftel 800 from the mobile device withKonftel Unite installed.

Before you begin

Ensure that Konftel 800 is connected to a mobile device with Konftel Uniteinstalled.

Procedure

• To disconnect from the mobile device, do the following:In Konftel Unite, tap the connection symbol in the upper left corner of thescreen.Tap the Disconnect button near the highlighted connected device name.

The connection symbol in the upper left corner of the screen becomesinactive.


152

• To disconnect from Konftel 800, do one of the following:

• Tap Konftel Unite > Disconnect Device.• Tap Settings > Konftel Unite > Disconnect Device.

The phone displays the following question: Disconnect device <DeviceName>?To confirm, tap Ok.

The phone shows the Konftel Unite icon and informs that the application isdisconnected.

Deleting pairingAbout this task

Use this procedure to delete the pairing between the conference phone and themobile device. You can delete the paring only from the conference phone.

Before you begin

Pair Konftel 800 with a mobile device with Konftel Unite.

Procedure

To delete the pairing from the conference phone, on the home screen, do oneof the following:

• Tap Konftel Unite.• Tap Settings > Konftel Unite.Tap Remove Bonding Information.Tap Ok to confirm removal of all bonding information from the device.

This function both disconnects the current connection and deletes the pairing.You must start a new pairing process the next time you want to connect to thephone.

Configuring the Konftel Unite settingsAbout this task

Use this procedure to configure the Konftel Unite settings from the applicationinstalled on a mobile device.

Procedure

Run Konftel Unite on your mobile device.Optional: Connect to Konftel 800.


153

The phone displays a connection symbol on the screen.Tap Settings and proceed with configuration.

Konftel Unite settingsThe following table lists the parameters for Konftel 800, which you can set fromthe Konftel Unite interface:

Name Description

Connection To enable or disable the connection to Konftel 800. Theoptions are:

• On: The default option.• Off: To use Konftel Unite without connection to any

Konftel 800. You can use the conferencing applicationfrom your mobile device within your mobile phonesubscription.

Moderator code To join the scheduled conference calls as a moderator. Youmust enter respective codes in the following fields:

• Use moderator code: To host conference calls over abridge service. For every call you join, Konftel Uniteuses your moderator code instead of your guest code.

• Instead of guest code: To specify the guest code insteadof which Konftel Unite uses your moderator code.

Dial prefix To enter the prefix digits in the Use prefix field.

My bridge To enter the phone number and optional PIN code of themost frequently used conference service. You can use theMy bridge button to join the conference call.

The My bridge button appears in the calendar view.

Meetingnotification

To set a reminder about a call. The options are:

• 5 minutes before• 10 minutes before• 15 minutes before• Never

Table continued…


154

Name Description

Calendars to show To select the calendars in the mobile phone from which youwant Konftel Unite to take the information.

Tell a colleague To share information about Konftel Unite with a person thatyou want. You can do it by using an email application.

After you confirm that Konftel Unite can access your emailapplication, you see a message created. Along with thedescription of the application, it contains links to KonftelUnite in App Store and Google Play so that the person caneasily start the download.

Read more aboutKonftel Unite

To get additional information about Konftel Unite. Theapplication forwards you to the web site with thecorresponding information.

Feedback andsupport

To share your experience of using the application andrequest for support. The options are:

• A messenger, for example, Viber, WhatsApp, Telegram,and so on.

• An email application.• Connection by Bluetooth®.

Diagnostics To select a log of the events for Konftel Unite.

You can send the created log by tapping Send through anemail application. The log can be used in troubleshooting.

You can also delete the logs from the application by tappingClear.

Show tutorial To read information about Konftel Unite features.

About KonftelUnite

To check the version of the application installed on yourmobile device.


155

COVERAGE EXPANSION

EXPANSION OF THE PHONE COVERAGEUse your Konftel 800 on larger conference tables or when the number of meetingparticipants is greater than 10. In this case, to ensure the high-level quality ofaudio signal, you can expand the phone coverage in the room without a PAsystem. To expand the phone coverage, connect Konftel Smart Mic expansionmicrophones to the phone or cascade several Konftel 800 devices in a daisychain.

Expansion of the phone coverage helps to improve the audio quality in largerooms. The conference phone and two Konftel Smart Mics increase the capturerange from 30 square meters to up to 70 square meters. Three phones in a daisychain increase the range from 30 square meters to up to 90 square meters.

Physical layoutYou can connect up to two Konftel Smart Mic expansion microphones to get anextended pick-up area. Each microphone has a pick-up range of 4 meters.

156

3

21

Figure 1: Front view of Konftel Smart Mic.

The following table lists the buttons and the other elements of Konftel Smart Mic:


1 Mute button

2 LED status indicator

3 Connection cable

Smart Mic characteristicsThe following table shows the dimensions, weight, and other characteristics ofKonftel Smart Mic:

COVERAGE EXPANSION

157

Parameter Value

Width 160 mm

Length 190 mm

Height 60 mm

Weight 220 g

Pick-up range 4 m

Connection Modular 6/6 jack

Expansion coverage arrangementArrange a daisy chain with your conference phone and another Konftel 800 orconnect Smart Mic expansion microphones. The maximum number of devicesconnected in a daisy chain is three. One Konftel 800 phone acts as a centraldevice (the “main” phone), and one or two other units act as expansion devices.

The typical arrangements when the coverage of the phone is expanded are thefollowing:

• Main phone — Expansion phone• Expansion phone — Main phone — Expansion phone• Main phone — Expansion microphone• Expansion microphone — Main phone — Expansion microphone• Expansion microphone — Main phone — Expansion phone

Functions of the Main and Expansion devicesWhen Konftel 800 acts as a main phone, it performs all its configured functions.

When Konftel 800 is in a subordinate position (an “expansion”), it performs thefollowing functions:

• Play audio received from the main device. The main phone defines the audiocharacteristics.

• Send its microphone audio to the main device.• Receive and indicate mute state changes made on the main device.• Send information to the main device when you tap Microphone Muted.

COVERAGE EXPANSION

158

• Send information to the main device when you adjust the volume on it.

You cannot make calls between the Main and the Expansion devices.

In a daisy chain, the Expansion device follows the signal from the Main deviceto enter Sleep mode or Active mode.

In a daisy chain, each phone is powered by its own PoE injector. The phonepowers the Smart Mics when these are connected. The power available from eachport is around 5 W.

Connection of the Expansion devices to the Main phoneIn a daisy chain, Konftel 800 disables all unused daisy chain ports during activecalls to provide for the best possible audio experience. That means, that the time,when an Expansion device activates, is dependent on the Main phone status asfollows:

• The Main phone is in the Idle state. When the user connects an expansionmicrophone or an Expansion phone to the Main phone, Konftel 800immediately detects it, and the connected device becomes directly availablefor operation.

• The Main phone has an active call. When the user connects an expansionmicrophone or an Expansion phone to the Main phone, the connected devicebecomes available for operation only after the call ends.

The same approach is applicable when the user disconnects and reconnectsan expansion microphone or an Expansion phone to the Main phone during anactive call. In this case, the connected device also becomes available foroperation only after the call ends.

Arranging a daisy chainAbout this task

Use this procedure to arrange a daisy chain of one main Konftel 800 phone andone or two expansion conference phones or expansion microphones.

Before you begin

If you arrange the daisy chain made of several conference phones, prepare theconnection cables. The cables in the Daisy Chain kit are 5 and 10 meters long.You can purchase the Daisy Chain kit as an accessory.

The cable of the Smart Mic is 3 m long.

COVERAGE EXPANSION

159

Procedure

Connect the cable to the audio expansion port on the phone.

There are 2 audio expansion ports on Konftel 800.Connect the other end of the cable to the audio expansion port of the otherphone.

In case of expansion microphones, the other end of the cable is fixed in thedevice.

Defining the mode of the phoneAbout this task

Use this procedure to define the mode of your Konftel 800 in a daisy chain.

Procedure

• To define the mode of your Konftel 800 on the phone, do the following:Log in as the administrator.In the Settings menu, tap Phone > Daisy Chain.Select the required mode.

The options are:

• Master• SlaveTap the Arrow Left icon three times to return to the home screen.

The phone restarts the application to apply the changes.• To define the mode of your Konftel 800 through the web interface, do the

following:On the web interface, click Phone.In Daisy Chain Mode, select the required mode from the drop-down list.

The options are:

• Master. This is the default mode.• SlaveClick Save.

The expansion unit displays the Daisy Chain Mode icon and the followingmessage: Daisy Chain. This message remains for the period when thephone is in Slave mode within the daisy chain arrangement.

COVERAGE EXPANSION

160

Disabling Daisy Chain modeAbout this task

Use this procedure to disable Daisy Chain mode through the web interface or fromthe phone.

Before you begin

Ensure that the phone displays the Daisy Chain icon.

Procedure

• To disable Daisy Chain mode from the web interface, do the following:On the web interface, click Phone.In Daisy Chain Mode, select Master.Click Save.

• To disable Daisy Chain mode from the phone, do the following:Touch the phone screen and enter the administrator password.Tap Phone > Daisy Chain.Select Master mode.Tap the Arrow Left icon three times to return to the home screen.

Application restarts and restores the Master status.

EXPANSION MICROPHONE FIRMWARE UPGRADEYou can upgrade the expansion microphone firmware to the Konftel 800 firmwareversion when your Smart Mic has an older firmware installed. Regularly updatingthe expansion microphone firmware to match the phone firmware ensures the bestpossible audio performance.

The phone suggests an automatic upgrade of the expansion microphone firmwarewhen you connect your Smart Mic to Konftel 800. You can connect one or twoSmart Mics simultaneously.

You can also initiate the expansion microphone firmware upgrade manually.

If you connect the expansion microphone to Konftel 800 during an active call, theupgrade does not start until the call ends.

During the upgrade, the phone rejects all incoming and outgoing calls and doesnot activate the Call Transfer feature. At that Konftel 800 indicates that it is Busy.

COVERAGE EXPANSION

161

Upgrading expansion microphone firmwareAbout this task

Use this procedure to upgrade the expansion microphone firmware when theSmart Mic and your device have different firmware installed.

Before you begin

Make sure Konftel 800 is in Idle Mode.

Procedure

Connect the expansion microphone to your conference phone using theavailable audio expansion port.

The expansion microphone LEDs flash red once.

A pop-up dialog window shows the following message: A connectedmicrophone needs firmware upgrade. Upgrade now?On the pop-up dialog window, tap Yes to start the upgrade.

The LEDs on the phone turn red to indicate that it is busy with the microphoneupgrade. The expansion microphone LEDs start flashing green.

The phone displays the Upgrade in progress message and shows theupgrade progress in percentage (0%-100%).

When you connect one Smart Mic to Konftel 800, the phone shows theupgrade status for Smart Mic 2 as N/A.

Smart Mic 1: 10%Smart Mic 2: N/AOptional: To cancel the upgrade, tap No.

In this case, you postpone the upgrade until the phone reboots.

Result

If the upgrade is complete, the microphone LEDs turn off, and Konftel 800 displaysthe following message:

Upgrade in progressSmart Mic 1: DoneSmart Mic 2: N/A

In 10 seconds, the pop-up dialog window hides, and the phone enters Idle mode.

COVERAGE EXPANSION

162

If the Smart Mic firmware upgrade fails, the microphone LEDs turn off, and thephone displays the Smart Mic 1: Failed message.

Upgrading two expansion microphonesAbout this task

Use this procedure to upgrade two expansion microphones connected to yourdevice simultaneously.

Before you begin

Connect Smart Mic 1 to the first audio expansion port of your conference phone.

Procedure

Connect Smart Mic 2 to your conference phone using the second audioexpansion port.

The LEDs on the phone turn red to indicate that it is busy with the microphoneupgrade. The Smart Mic 2 LEDs start flashing green.

A pop-up dialog window provides the expansion microphones upgrade status inthe following format:

Smart Mic 1: 20%Smart Mic 2: 10%Optional: Terminate Smart Mic 2 upgrade by detaching the expansionmicrophone from the phone.

In this case, you postpone the upgrade until you connect Smart Mic 2 again.

Result

When the upgrade is complete for Smart Mic 1 and Smart Mic 2 is still upgrading,the LED turns off on Smart Mic 1, and Konftel 800 displays the following message:

Upgrade in progressSmart Mic 1: DoneSmart Mic 2: 86%

When the upgrade is complete for both microphones, their LEDs turn off, andKonftel 800 displays the following message:

Upgrade in progressSmart Mic 1: DoneSmart Mic 2: Done

COVERAGE EXPANSION

163

In 10 seconds, the pop-up dialog window hides, and the phone enters Idle mode.

If the firmware upgrade for any of the expansion microphones fails, themicrophone LEDs turn off, and the phone displays the message stating theFailed status of the corresponding Smart Mic.

Terminating expansion microphone upgradeAbout this task

Use this procedure to terminate the expansion microphone upgrade.

You can do it in the following cases:

• The phone has one Smart Mic 1 connected; or• The phone has both Smart Mic 1 and Smart Mic 2 connected simultaneously.

Before you begin

Connect Smart Mic 1 and Smart Mic 2 to the phone and start the upgrade processfor both expansion microphones.

Procedure

Detach Smart Mic 2 from the phone.

Smart Mic 1 continues upgrading with the value for the upgrade progress beingupdated.

Smart Mic 2 upgrade dialog indicates an error and aborts the mic upgrade.Konftel 800 displays the following message:

Upgrade in progressSmart Mic 1: 50%Smart Mic 2: Failed

When Smart Mic 1 upgrade is complete, its LED turns off, and Konftel 800displays the following message:

Upgrade in progressSmart Mic 1: DoneSmart Mic 2: Failed

This message disappears in 10 seconds.Optional: To upgrade Smart Mic 2, connect it to the conference phone andproceed with the upgrade.

COVERAGE EXPANSION

164

Upgrading Smart Expansion Microphone manuallyAbout this task

Upgrade your expansion microphone manually when it is convenient to you.

Procedure

Hold the Microphone Muted button on the Smart Mic while you connect themicrophone cable, and keep holding the button for 5 seconds after you insertedthe cable.

When you release the button, it flashes red one time and then starts flashinggreen to indicate that the upgrade process has started. The LEDs on the phoneturn red to indicate that it is busy with the microphone upgrade. The upgradeprocess takes about 7 minutes. When the upgrade is completed, themicrophone LEDs turn off.Check the microphone version by doing one of the following:

• On the phone screen, tap Settings > Status.• On the web interface, go to the Status tab.

COVERAGE EXPANSION

165

MAINTENANCE

SYSTEM RECOVERYAs an administrator, you can perform system recovery on Konftel 800 to return thephone to operable state, for example, after a faulty upgrade or when the phoneapplication fails. System recovery replaces the current firmware with thepreviously installed operable firmware version.

You can also perform system recovery to reset the administrator password.

System recovery erases all settings including the account information.

Performing system recoveryBefore you begin

Ensure that you save the configuration file from your Konftel 800. System recoveryerases all settings.

Procedure

Power cycle the phone to start the boot process.When the LEDs turn green, start tapping the Microphone Muted button on thephone and continue tapping until the LEDs turn off.Tap the Microphone Muted button once again.When the LEDs turn red, tap the Volume up button once to confirm the systemrecovery.

The LEDs turn off. The phone starts regular boot. After the boot up, the phonedisplays the following message: Upgrade the phone to completerecovery.

If you want to cancel the system recovery, do not tap Volume up button onthe phone when the LEDs turn red.

After the phone boots up, set the administrator password.Upgrade the phone to complete system recovery.

Next steps

Upload the configuration file with necessary settings.

Related tasksSetting the password for Konftel 800 on page 21

166

REMOTE SYSLOG SERVERKonftel 800 supports syslog protocol to allow centralized log management. Youcan configure the phone so that it logs to a remote server and sends the syslogmessages to your own system or a third-party system.

With the remote syslog feature enabled, the phone sends the syslog messages tothe syslog server and also logs them in the local log.

By default, the remote logging feature on Konftel 800 is in the disabled state.

Configuring remote syslog settingsAbout this task

To use the remote syslog feature, you need to do the following:

• Enable your phone to deliver syslog messages to the syslog server.• Configure the destination server which receives the syslog events.

You can do this using the configuration file stored on the Device Managementserver. You can find the syslog settings under the <logging> section of theconfiguration file.

The default syslog port is 514, and you cannot change this setting.

The <remote_syslog_host> tag can be missing in the <logging> sectionif you use a configuration file exported from the phone application. This canhappen because the <remote_syslog_host> default value is blank, and thephone application does not export blank tags.

Before you begin

Obtain the configuration .xml file for Konftel 800.

Procedure

In the configuration file, go to the <logging> section.Set the value in the <remote_syslog_enable> tag to true as shown in thefollowing example:

<remote_syslog_enable>true</remote_syslog_enable>Specify the host URL in the <remote_syslog_host> tag as shown in thefollowing example:

<remote_syslog_host>1.2.3.4</remote_syslog_host>Replace the 1.2.3.4 with the IP address or hostname of your remote syslogserver.

MAINTENANCE

167

Save the configuration file.

Next steps

Upload the configuration file to the Device Management server or import theconfiguration file to the phone using the web interface.

The phone sends syslog messages to the syslog server after the next reboot. Thephone continues sending syslog messages until you set the<remote_syslog_enable> parameter in the configuration file to false.

Related tasksImporting the configuration file on page 123Exporting the configuration file on page 122Related informationConfiguration parameters on page 35

FALL BACK SERVER SUPPORTKonftel 800 registers concurrently with the primary and secondary proxy servers.The phone also supports provisioning of a third-party fall back server when aconnection with the primary or secondary server cannot be established. You canconfigure the third-party server details by using the web interface and theconfiguration file.

FACTORY RESETIf for any reason, you must restore the factory settings on your Konftel 800, youcan do it by means of the factory reset. In this case the phone removes all user-specific settings and returns to the factory settings. After the procedure iscompleted, you can repeatedly configure the settings.

Performing factory resetAbout this task

You can reset your Konftel 800 to factory default. You can do the factory reset onlyon the phone after you log in as the administrator.

If you need to perform the factory reset without logging in as the administrator,follow the procedure described in Performing system recovery on page 166.

MAINTENANCE

168

Procedure

Log in to the phone as the administrator.On the phone screen, tap Settings > Phone.Tap Factory Reset.

The phone shows the following message: Reset configuration tofactory default. Press OK to confirm.Tap Ok to confirm the reset.Optional: Tap Cancel to return to the Phone settings.

DEVICE STATUS VIEWYou can view the configured settings of your Konftel 800 through the web interfaceand get information about the device, logs, and licenses.

You can use this information for troubleshooting.

Device statusYou can find the information about Konftel 800 status, including its currentsettings, through the web interface. This information can be useful fortroubleshooting.

The following table describes the type of the information available in each of theStatus tab sections.

Section name Description

General To show the status information of Konftel 800, includingthe following:

• Phone Name• Product Name• Build Version• HW Revision• Serial Number• Smart Microphone 1 Version• Smart Microphone 2 Version

MAINTENANCE

169

Section name Description

Network To show the information about the network settings ofthe phone. You can see the following information:

• IP Address• MAC Address• Bluetooth MAC Address• Hostname• Network Mask• Domain• Gateway• Primary DNS• Secondary DNS

SIP To show the information about the SIP settings of thephone. You can see the following information:

• Primary Account Status• Secondary Account Status• Fallback Account Status

Time and Region To show the information about the time and regionsettings of the phone. You can see the followinginformation:

• NTP Status• Time• Date• Timezone• Daylight Saving Time

You can not change settings in the Status tab.

Viewing the phone statusAbout this task

Use this procedure to view the status and settings of Konftel 800 through the webinterface.

MAINTENANCE

170

Procedure

Log in to the web interface.Select the Status tab.

System logsInformation about log messages is available through the web interface in theSystem Logs tab. These log types can be useful for troubleshooting.

You can select the following log types:

• All Logs. This is the default setting.• System Logs• PhoneApp Logs• Linux Kernel Logs• Bluetooth Stack Logs• PJSIP logs• Device Management• SIP traces• Device Management Debug

You can also specify custom logs type in the Custom logs type field.

You can not access logs through the phone user interface.

Viewing system logsAbout this task

Use this procedure to choose and form the log messages through the webinterface.

Procedure

On the web interface, click System logs.Under Select Logs Type, select the log from the list.Click the Filter button.

You can see the logs of the selected type in the field below.Optional: You can do the following:

• Click the Download All Logs button to download all the logs available.Here, the system downloads a .zip archive with the logs available.

MAINTENANCE

171

• Click the Download Selected Logs button to download the logs of aselected type. Here, the system downloads a .txt file with the logs of theselected type.

• Click the Clear All Logs button to clear the list of available logs.

PJSIP log levelsKonftel 800 uses the PJSIP library in its real-time media communication. PJSIP isa free and open-source multimedia communication library working with standard-based protocols such as SIP, STUN, and TURN. This library also combines threemain components of real-time multimedia communication: signaling, mediafeatures, and NAT traversal.

You can use PJSIP logs for information and troubleshooting.

Konftel 800 provides the following PJSIP log levels:

• Fatal. This is the least detailed printout. You can see those events that are fatalfor the operation.

• Error. You can see the list of error events.• Warning. You can see the list of warnings relevant to the device operation.• Info. You can see information about the actions of the device. This is the

default option.• Debug. You can get information about specific actions of the device and use it

for debugging.• Trace. This is the most detailed printout. You can see all the actions made by

the device.

You can set the PJSIP log level through the web interface or using aconfiguration .xml file.

Setting PJSIP log level through the web interfaceAbout this task

Use this procedure to manually set the PJSIP log level to generate a log messageprintout with the required details. For example, when you enable a higher log level,you receive useful information for troubleshooting.

Before you begin

Log in to the web interface.

Procedure

On the web interface, click the System logs tab.Choose the required value from the PJSIP Log Level list.

MAINTENANCE

172

The value depends on the level of printout details provision you need.Click Save.

The phone restarts the application to apply the changes.

Next steps

Check the PJSIP printout information.

Setting PJSIP log level using the configuration fileAbout this task

Set PJSIP log level using the .xml configuration file to generate a detailed logmessage printout. For example, when you set a higher log level, you receiveuseful information for troubleshooting. When you boot the phone afterprovisioning, the setting file is changed depending on the configuration of thestandard encryption use.

Before you begin

Obtain the configuration .xml file for Konftel 800.

Procedure

Open the configuration file.In the <logging> section, locate the <pjsip_log_level> tag and set thenecessary value.

The value range is from 0 to 5. The values correspond to the following fivelevels with different printout detalization:

• 0: Fatal• 1: Error• 2: Warning• 3: Info• 4: Debug• 5: Trace. This is the most detailed printout.Save the configuration file.

The phone reboots if the PJSIP log level value differs from the previouslyconfigured value.

On the web interface, the PJSIP Log Level value changes to reflect the valuefrom the configuration file.

MAINTENANCE

173

Next steps

Upload the configuration file to the Device Management server or import theconfiguration file to the phone using the web interface.


Network logsYou can get the traces of the phone network activities through the web interface inthe Network Logs tab. The network logs can be useful for troubleshooting.

You can get network logs only after the phone reboots into Network logs mode.

Viewing network logsAbout this task

Use this procedure to choose and form the network log messages through theweb interface.

Procedure

On the web interface, click Network logs.You can do the following:

• Click the Reboot Into Network Log Mode button to reboot the phone intoNetwork log mode.

• Click the Download Network Logs button to download the archive with theavailable network logs.

LICENSESOn the Licenses web page, you can get the general information about the use andother conditions for the third party components. This web page also contains acopyright URL by using which you can find and download the document with acomplete list of the third party components and licenses.

You can get the license information only through the web interface.

MAINTENANCE

174

SPECIFICATIONS

SPECIFICATIONSThe following table lists the specifications that Konftel 800 supports:

Name Description

Power • PoE 802.3af• PoE 802.3at• PoE injector available as an accessory

Connectivity • Ethernet RJ45 10/100 Mbps, PoE 802.3af, and PoE802.3at

• USB 3.0 device• Built-in Bluetooth® LE and NFC• Bluetooth® Classic (HFP, A2DP)• Daisy Chain (audio) ports (6-pin RJ-type)

Screen Graphical touch screen with a resolution ofapproximately 480 x 800 and size of 4.3”

Acoustics • 3 symmetrically placed MEMS microphones• Full range speaker in the sealed enclosure

Music • PoE 802.3at: 91 dB and bass boost• PoE 802.3af: 87 dB (audio output reduced due to

lower PoE power level)• Daisy Chain: 91 dB

Speech • PoE 802.3at: 91 dB• PoE 802.3af: 87 dB (audio output reduced due to

lower PoE power level)• Daisy Chain: 91 dB

USB • Micro USB 3.0 device Type B• USB Type A

175

Name Description

Bluetooth® • Bluetooth® LE• Bluetooth® Classic (HFP, A2DP)

Accessories You can additionally purchase the followingaccessories:

• Konftel PoE kit• Konftel Smart Microphones• Konftel Daisy Chain kit

User interface • Simplified user interface• Functional keypad and dial pad• LED indicators for call and connectivity status

Mobile app Konftel Unite. With the app, you can access your mobilephone contact book and calendar. The app is availablefor free at AppStore and Google Play

Device Configuration • Global .xml or MAC specific .xml configuration files• Web GUI administration

SPECIFICATIONS

176

APPENDIX A. ENCRYPTION METHODS INLEGACY ENCRYPTION MODE

ENCRYPTION METHODS IN LEGACY ENCRYPTIONMODEThe following table lists the encryption methods enabled and disabled in Legacyencryption mode:

Cipher 802.1X LDAP SIPTLS

HTTPS LegacyCipher

TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA256

Y Y Y

TLS_DHE_DSS_WITH_AES_128_CBC_SHA

Y Y Y

TLS_DHE_RSA_WITH_AES_128_GCM_SHA256

Y Y Y Y N

TLS_DHE_RSA_WITH_AES_256_GCM_SHA384

Y Y Y Y N

TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256

Y Y Y Y N

TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384

Y Y Y Y N

TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256

Y Y Y Y N

TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384

Y Y Y Y N

TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

Y Y Y Y N

Table continued…

177


HTTPS LegacyCipher

TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384

Y Y Y Y N

TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

Y Y Y Y N

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

Y Y Y Y N

TLS_RSA_WITH_AES_128_GCM_SHA256

Y Y Y Y N

TLS_RSA_WITH_AES_256_GCM_SHA384

Y Y Y Y N

TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA

Y Y Y Y

TLS_DHE_RSA_WITH_AES_128_CBC_SHA

Y Y Y Y Y

TLS_DHE_RSA_WITH_AES_128_CBC_SHA256

Y Y Y Y Y

TLS_DHE_RSA_WITH_AES_256_CBC_SHA

Y Y Y Y Y

TLS_DHE_RSA_WITH_AES_256_CBC_SHA256

Y Y Y Y Y

TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA

Y Y Y Y

TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA

Y Y Y Y Y

Table continued…

APPENDIX A. ENCRYPTION METHODS IN LEGACYENCRYPTION MODE

178


HTTPS LegacyCipher

TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256

Y Y Y Y Y

TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA

Y Y Y Y Y

TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384

Y Y Y Y Y

TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA

Y Y Y Y

TLS_ECDH_RSA_WITH_AES_128_CBC_SHA

Y Y Y Y Y

TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256

Y Y Y Y Y

TLS_ECDH_RSA_WITH_AES_256_CBC_SHA

Y Y Y Y Y

TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384

Y Y Y Y Y

TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA

Y Y Y Y

TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA

Y Y Y Y Y

TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256

Y Y Y Y Y

TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA

Y Y Y Y Y

Table continued…


179


HTTPS LegacyCipher

TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384

Y Y Y Y Y

TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA

Y Y Y Y

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA

Y Y Y Y Y

TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

Y Y Y Y Y

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA

Y Y Y Y Y

TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384

Y Y Y Y Y

TLS_RSA_WITH_3DES_EDE_CBC_SHA

Y Y Y Y

TLS_RSA_WITH_AES_128_CBC_SHA

Y Y Y Y Y

TLS_RSA_WITH_AES_128_CBC_SHA256

Y Y Y Y Y

TLS_RSA_WITH_AES_256_CBC_SHA

Y Y Y Y Y

TLS_RSA_WITH_AES_256_CBC_SHA256

Y Y Y Y Y

TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA

Y Y

TLS_DHE_DSS_WITH_AES_128_CBC_SHA256

Y Y


180

IndexSpecial Characters.xml configuration files 24.xml file

editing 25modification 25

Numerics802.1.x settings 35802.1x

standard encryption 143

Aadministration

by using the touch screen 32through the web interface 28

application to manage the phone151area code 35

BBluetooth

audio streaming 113deleting pairing 115paired devices connection 116paired devices reconnection116pairing 115reconnection 116

Bluetooth Classic 113profiles 114

Bluetooth deviceautomatic reconnection 116

Bluetooth LE 113Bluetooth media device 10Bluetooth radio 117

disabling 117button 156buttons 12

CCA certificate 35, 135, 140

provisioning through SCEP148

Caller ID 107

caller information 107Caller name 107capability negotiation 35centralized device management 10certificate application 140

converting the certificatesto .PEM format 141downloading the root certificate140exporting the private key 141

certificate configuration filestructure 136

certificate configuration files 135certificates application 139changing password 35codec 35codecs 106conference phone 10configuration

advance settings 148centralized http/https server 22HTTP/HTTPS server 21media port range 103methods 21migration 125multiple devices 132phone interface 21phone settings 96settings 33usb ports 120web interface 21web interface settings 148

configuration fileediting 123export 122import 123structure 35validation 27

configuration parameters 35configuring

Use Static Source Port 108

181

connecting to a network with DHCP23connection

using Bluetooth 113connection layout 13country code 35cross-site request forgery 150

Ddaisy chain

arranging 159cascading 156defining mode 160disabling mode 161expansion microphones 156expansion phone 158, 159main phone 158, 159master phone 156slave phone 156

daisy chain arrangement 158daisy chain mode 35data input

data type 95length restriction 95validation 95

daylight saving time 35Daylight Saving Time

configuring through webinterface 97state 98

device certificate 35Device certificate 135device information 169Device Management 129Device Management Server 129device private key 35DHCP 35, 98, 109DHCP configuration options 22DHCP SSON 22dimensions 12, 18, 156, 157DNS server

primary 35secondary 35

document changes 7downgrade 124

DTMF 35

EEAP MD5 settings 35EAP TLS settings 35encryption methods

legacy encryption mode 177expansion microphone

automatic firmware upgrade161firmware upgrade 162, 163firmware upgrade termination164manual firmware upgrade 161,165

expansion microphones 156external prefix settings 35

Ffactory reset 35, 168fall back server 168fallback account 35, 106FIPS 145FIPS mode 145

media encryption with SRTP145

firmwaredowngrading 124upgrading 124

firmware downgrade 122configuration retention 129

firmware rollback 122firmware upgrade

multiple devices 131using mass storage device withadministrator password 128using mass storage devicewithout administrator password127using the downloaded file 124using USB mass storagedevice 126

first media port 35

GG722 Priority 35

INDEX

182

G729 Priority 35gateway 35

Hhostname to ip address mapping109

Iicons 12, 14

usb only user mode 119iLBC Priority 35individual device management 10installing the certificate 140intended audience 6

Kkey tone 35

Llast media port 35LDAP

connection 35dial options 35settings 35

legacy encryption 144legacy encryption mode 142, 144

encryption methods 177licenses 174LLDP Data Units 110LLDP settings 35logging in 30logs 169

Mmaster phone 158media encryption with SRTP

FIPS mode 145standard encryption 144

media port rangeconfiguration 103, 105

media settings 35, 99

NNAT Traversal 35netmask 35network

domain 35

network (continued)hostname 35

network logs 174network settings 35, 109NTP server address 98

OOPUS Priority 35Out-of-box experience 20outbound Proxy 35overview 10

Ppassword

reset 166setting 21

PCMA Priority 35PCMU Priority 35phone language 35phone management application

configuring settings from themobile device 153deleting pairing 153disconnecting devices 152pairing and connecting devices151settings 154

phone name 35phone reboot

from the phone's user interface96

phone settingssecurity 35

physical layout 12, 156pick-up range 157PJSIP log level 172

setting through web interface172setting using configuration file173

PJSIP logs 172power-saving mode 99primary account 35, 106protection against CSRF 150purpose 6

INDEX

183

Rreboot device 35rebooting the phone

from the phone's user interface96

registration with the ZTI devicemanagement service 131remote port 35remote syslog

configuring 167remote syslog server 167reset

to factory default 168to previous firmware version166

reset to factory settings 168ringtone level 35rollback 124root certificate 140RTCP XR

collector URI 102enabling 102parameters 100quality estimate metrics 101

Ssafety guidelines 18safety instructions 18SCEP

auto-renewal 147background polling 146CA certificate provisioning 148certificate management 146configuring renewal request147enrollment 146

secondary account 35, 106security methods 134security protocols 134session Expiration 35session Timers 35setting PJSIP log level

through web interface 172using configuration file 173

setting static IP addressfrom the phone 30through the web interface 30

settingsconfiguring on the phone 33

settings configurationthrough the web interface 31

SIP account 35registration status 106

SIP endpoint 10SIP invite 107SIP settings 35, 106SIP traces

enable 35Site Specific Option Number 22slave phone 158sleep mode 99Smart Mic 156

automatic upgrade 161manual upgrade 161, 165upgrade 162, 163upgrade termination 164

source port 35, 106specifications 175SRTCP 35SRTP 35standard encryption 142

802.1x 143media encryption with SRTP144

start up sound 35static IP 35, 109status 169

viewing 170STUN Server 35syslog 167system logs 171system recovery 166

procedure 166

Ttime and region settings 35TLS 35, 106touch screen administration 32transport protocol 35, 106

INDEX

184

TURN Server 35

UUSB media device 10usb only user mode 118

icons 119time presentation 118volume control andsynchronization 119

usb portsconfiguration 120

use static source port 35Use Static Source Port

configuring 108

Vvalid input 95viewing

firmware version 29IP address 29MAC address 29network logs 174system logs 171

VLAN 35VLAN ID 35voice quality monitor settings 35voice quality monitoring 100

quality estimate metrics 101

Wweb access

configuring on the phone 149configuring through the webinterface 149configuring using theconfiguration file 149

web administration 28web administrator 28web interface 30

logging out 31webapp debug 35weight 157

INDEX

185

Rev 1.0.6 - 2021-10

-25K O N F T E L . C O M

Konftel AB, Box 268, SE-901 06 Umeå, Sweden

Tel: +46 90 70 64 89 E-mail: [email protected]

Konftel is a leading company within collaboration endpoint solutions. Since 1988, our

mission has been to help people in businesses around the world to have meetings

regardless of distance. We know that remote collaboration is an effective way to save

time, money and contribute to a more sustainable world. We are Climate Neutral

Certified, offering customers an option to purchase video conferencing equipment

while keeping a clear climate conscience. Crystal clear audio and a sharp video

image are essential for efficient meetings; this is why we only focus on cutting-edge

technology in our Collaboration Solutions. Our audio technology OmniSound® is built

into all Konftel Conference phones and devices. The products are sold globally under

the Konftel brand and our headquarters are based in Sweden. Read more about the

company and our products at konftel.com.

Documents

Installation & Administration of Konftel 800