Linksys SPA921 Cisco Small Business IP Telephony Devices Provisioning Guide - Page 39

can be accomplished securely by using HTTPS.

Get Linksys SPA921 - Cisco - IP Phone PDF manuals and user guides
UPC - 745883570799
View all Linksys SPA921 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 39 highlights

Creating Provisioning Scripts Open Format Configuration File 2 If the file is encrypted, the profile expects the file to have the same format as generated by the following command: # example encryption key = SecretPhrase1234 openssl enc -e -aes-256-cbc -k SecretPhrase1234 -in profile.xml -out profile.cfg # analogous invocation for a compressed xml file openssl enc -e -aes-256-cbc -k SecretPhrase1234 -in profile.xml.gz -out profile.cfg A lower case -k precedes the secret key, which can be any plain text phrase and is used to generate a random 64-bit salt. Then, in combination with the secret specified with the -k argument, it derives a random 128-bit initial vector, and the actual 256-bit encryption key. When this form of encryption is used to encrypt a configuration profile, the IP Telephony Device needs to be informed of the secret key value to decrypt the file. This value is specified as a qualifier in the pertinent profile URL. The syntax is as follows, using an explicit URL: [--key "SecretPhrase1234"] http://prov.telco.com/path/profile.cfg This value is programmed using one of the Profile_Rule parameters. The key must be preprovisioned into the unit at an earlier time. This bootstrap of the secret key can be accomplished securely by using HTTPS. Preencrypting configuration profiles offline with symmetric key encryption allows the use of HTTP for resyncing profiles. The provisioning server uses HTTPS to handle initial provisioning of IP Telephony Devices after deployment. This feature reduces the load on the HTTPS server in large scale deployments. The final file name does not need to follow a specific format, but it is conventional to end the name with the .cfg extension to indicate that it is a configuration profile. Cisco Small Business IP Telephony Devices Provisioning Guide 37

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
Creating Provisioning Scripts
Open Format Configuration File
Cisco Small Business IP Telephony Devices Provisioning Guide
37
2
If the file is encrypted, the profile expects the file to have the same format as
generated by the following command:
# example encryption key = SecretPhrase1234
openssl enc –e –aes-256-cbc –k SecretPhrase1234 –in profile.xml –out
profile.cfg
# analogous invocation for a compressed xml file
openssl enc –e –aes-256-cbc –k SecretPhrase1234 –in profile.xml.gz –out
profile.cfg
A lower case –k precedes the secret key, which can be any plain text phrase and
is used to generate a random 64-bit salt. Then, in combination with the secret
specified with the –k argument, it derives a random 128-bit initial vector, and the
actual 256-bit encryption key.
When this form of encryption is used to encrypt a configuration profile, the IP
Telephony Device needs to be informed of the secret key value to decrypt the file.
This value is specified as a qualifier in the pertinent profile URL. The syntax is as
follows, using an explicit URL:
[--key “SecretPhrase1234”] http://prov.telco.com/path/profile.cfg
This value is programmed using one of the Profile_Rule parameters. The key must
be preprovisioned into the unit at an earlier time. This bootstrap of the secret key
can be accomplished securely by using HTTPS.
Preencrypting configuration profiles offline with symmetric key encryption allows
the use of HTTP for resyncing profiles. The provisioning server uses HTTPS to
handle initial provisioning of IP Telephony Devices after deployment. This feature
reduces the load on the HTTPS server in large scale deployments.
The final file name does not need to follow a specific format, but it is conventional
to end the name with the .cfg extension to indicate that it is a configuration profile.