innovaphone wiki - User contributions [en]

Specyfikacja IP174

2026-10-08T11:20:46Z

Vsc:

{{datasheet_header|innovaphone IP174|Stacja interkomowa}}
<div class="datasheets-mehrspaltig">
[[Image:IP174-x.png]]
===Oprogramowanie===
Urządzenie działa z wersją 16 i nowszą
===Obudowa===
* Montaż naścienny
* Głośnik przedni – 80 mm, 4 omy, tworzywo sztuczne
* Obudowa IP66 do montażu na zewnątrz, pylo- i wodoszczelna, odporna na mgłę solną
* Klawisze foliowe
* IP174-1: jeden klawisz szybkiego wybierania
* IP174-4: 4 klawisze szybkiego wybierania
* IP174: 12-klawiszowa klawiatura telefoniczna
* Każdy model: 3 klawisze trybu połączeń (głośnomówiący, bezpośredni/priorytetowy, PTT), 2 klawisze głośności
* Wskaźnik połączenia
* Wymiary (szer. x gł. x wys.): 130 x 70 x 303 mm
* Waga: ok. 1500 gramów
===Interfejsy===
* 10/100-BASE-TX (auto negocjacja), RJ-45 (modular Jack 8P8C)
* Zewnętrzny zasilacz 24 V (wejście)
* Wyjście 24 V DC (500 mA)
* Przekaźnik (NO/NC)
* Słuchawka (6-żyłowa)
* Zestaw słuchawkowy (6-żyłowy) z obsługą PTT
* Głośnik zewnętrzny
* Tylny port USB – wyłącznie do użytku wewnętrznego
===Hardware===
* Zasilanie: „Power over Ethernet+” zgodnie z IEEE 802.3at, Class 4
* 128 MB pamięci RAM, 16 MB pamięci Flash
* Temperatura pracy: od -25 °C do +70 °C
* Wilgotność: od 10% do 90% (bez kondensacji)
* Temperatura przechowywania: od -10 °C do +70 °C
{{Template:Leistungsmerkmale PL - Sprach Coder|G.722, Opus-NB, Opus-WB, G.729 (od 15r1sr16/16r1sr4)}}
{{Template:Leistungsmerkmale PL - Voip Protokolle13}}
{{Template:Leistungsmerkmale PL - Netzwerk13}}

Tunelowanie PPTP do 4 tuneli jednocześnie, szyfrowanie za pomocą MPPE
{{Template:Leistungsmerkmale PL - Administration13}}
===Funkcje dodatkowe===
* Przycisk głośnomówiący – połączenia głośnomówiące w trybie pełnego dupleksu
* Przycisk bezpośredniego połączenia – pełnodupleksowe dołączanie do rozmowy w stanie bezczynności lub zajętości (funkcję można wyłączyć)
* Przycisk PTT – funkcja Talkback i klasyczne użycie PTT (funkcja wyciszenia mikrofonu)
* Komunikaty strefowe – nieograniczona liczba stref
{{Template:Leistungsmerkmale PL - Lizenzen Telefone}}
{{Template:CE-Decl_Phones|Deklaracje zgodności|patrz oddzielny arkusz informacyjny}}
===Numer katalogowy IP174-1: 01-01741-001===
===Numer katalogowy IP174-4: 01-01744-001===
===Numer katalogowy IP174: 01-17415-001===
</div>
{{Template:Datasheet_footer|PL}}
[[Category:Specyfikacja techniczna Phones PL|{{PAGENAME}}]]

Technische gegevens IP174

2026-10-08T11:20:25Z

Vsc:

{{datasheet_header|innovaphone IP174|Opbouw intercom station}}
<div class="datasheets-mehrspaltig">
[[Image:IP174-x.png]]
===Firmware===
Het toestel is compatibel met firmware versie 16 en hoger
===Behuizing===
* Wandmontage, Opbouwmontage behuizing
* Voorijde speaker-80mm, 4 Ohm, plastic
* IP66 Behuizing voor gebruik in de buitenlucht, stof- en waterdicht, bestand tegen zout en nevel
* Folie toetsenbord
* IP174-1: een snelkeuze toets
* IP174-4: 4 snelkeuze toetsen
* IP174: 12 snelkeuze toets en telefoontoetsenbord
* Elke model: 3 toetsen voor gespreksmodus (handenvrij, direct/prioriteit, PTT), 2 volumetoetsen
Oproep indicator
* Afmetingen (W x D x H): 130 x 70 x 303 mm
* Gewicht: ca. 1500 grams

===Interfaces===
* 10/100-BASE-TX (auto negotiation), RJ-45 (modular Jack 8P8C)
* 24V PSU external power supply (input)
* 24V DC output (500mA)
* Relay (NO/NC)
* Handset (6-draads)
* Headset (6-draads) PTT ondersteuning
* Externe Speaker
* Achterzijde USB port - enkel voor intern gebruik

===Hardware===
* Voeding: „Power over Ethernet+“ volgens IEEE 802.3at, klasse 4
* 128MByte RAM, 16MByte Flash
* Werk temperatuur: +5 °C to +55 °C
* Luchtvochtigheid: 10% to 90% (niet condenserend)
* Opslag temperatuur: -10 °C to +70 °C
{{Template:Leistungsmerkmale NL - Sprach Coder|G.722, Opus-NB, Opus-WB, G.729 (vanaf 15r1sr16/16r1sr4)}}
{{Template:Leistungsmerkmale NL - Voip Protokolle13}}
{{Template:Leistungsmerkmale NL - Netzwerk13}}

PPTP Tunneling tot 4 tunnels gelijktijdig, encoding via MPPE
{{Template:Leistungsmerkmale NL - Administration13}}
===Aanvullende functies===
* Handenvrij toets – Full duplex handenvrij bellen
* Directe oproep toets – Full duplex inbreken op toestellen die vrij of bezet zijn (kan uitgeschakeld worden)
* PTT toets – Terugspreken en klasieke PTT funktie gebruik (microfoon mute functie)
* Zone announcements – ongelimiteerde zones
{{Template:Leistungsmerkmale NL - Lizenzen Telefone}}
{{Template:CE-Decl_Phones|Conformiteiten|zie afzonderlijk informatieblad}}
===Bestelnummer IP174-1: 01-01741-001===
===Bestelnummer IP174-4: 01-01744-001===
===Bestelnummer IP174: 01-17415-001===
</div>
{{Template:Datasheet_footer|NL}}
[[Category:Technische gegevens Phones NL|{{PAGENAME}}]]

Dati tecnici IP174

2026-10-08T11:20:11Z

Vsc:

{{datasheet_header|innovaphone IP174|Postazione intercom}}
<div class="datasheets-mehrspaltig">
[[Image:IP174-x.png]]
===Firmware===
Dispositivo funzionante dalla Versione 16 o successive
===Box===
* Montaggio a parete
* Altoparlante frontale da 80 mm, 4 Ohm, plastica
* Box IP66 per uso esposto, a tenuta di polvere e acqua, resistente alla nebbia salina
* Tasti a membrana
* IP174-1: un tasto di selezione rapida
* IP174-4: 4 tasti di selezione rapida
* IP174: tastierino telefonico a 12 tasti
* Ogni modello: 3 tasti modalità chiamata (vivavoce, diretto/priorità, PTT), 2 tasti volume
* Indicatore di chiamata
* Dimensioni (L x P x A): 130 x 70 x 303 mm
* Peso: ca. 1500 g
===Interfacce===
* 10/100-BASE-TX (auto negotiation), RJ-45 (modular Jack 8P8C)
* Alimentazione esterna 24 V PSU (ingresso)
* Uscita 24 V DC (500 mA)
* Relè (NO/NC)
* Cornetta (6 fili)
* Cuffia (6 fili) con supporto PTT
* Altoparlante esterno
* Porta USB posteriore - solo per uso interno
===Hardware===
* Alimentazione: “Power over Ethernet+” secondo IEEE 802.3at, Classe 4
* 128 MByte RAM, 16 MByte Flash
* Temperatura di esercizio: da -25 °C a +70 °C
* Umidità: dal 10% al 90% (senza condensa)
* Temperatura di stoccaggio: da -10 °C a +70 °C
{{Template:Leistungsmerkmale IT - Sprach Coder|G.722, Opus-NB, Opus-WB, G.729 (da 15r1sr16/16r1sr4)}}
{{Template:Leistungsmerkmale IT - Voip Protokolle13}}
{{Template:Leistungsmerkmale IT - Netzwerk13}}

Tunneling PPTP fino a 4 tunnel simultanei, cifratura tramite MPPE
{{Template:Leistungsmerkmale IT - Administration13}}
===Caratteristiche supplementari===
* Tasto vivavoce – chiamate vivavoce full duplex
* Tasto Direct in – intrusione full duplex su libero o occupato (disattivabile)
* Tasto PTT – uso talkback e PTT classico (funzione di mute del microfono)
* Annunci di zona – zone illimitate
{{Template:Leistungsmerkmale IT - Lizenzen Telefone}}
{{Template:CE-Decl_Phones|Conformità|vedere foglio informativo separato}}
===Numero d'ordine IP174-1: 01-01741-001===
===Numero d'ordine IP174-4: 01-01744-001===
===Numero d'ordine IP174: 01-17415-001===
</div>
{{Template:Datasheet_footer|IT}}
[[Category:Dati tecnici Phones IT|{{PAGENAME}}]]

Fiche technique IP174

2026-10-08T11:19:54Z

Vsc:

{{datasheet_header|innovaphone IP174|Poste d'interphone}}
<div class="datasheets-mehrspaltig">
[[Image:IP174-x.png]]
===Firmware===
L'appareil fonctionne avec la version 16r1 ou supérieure
===Boîtier===
* Montage mural
* Haut-parleur frontal 80 mm, 4 Ohm, plastique
* Boîtier IP66 pour utilisation en environnement exposé, étanche à la poussière et à l’eau, résistant au brouillard salin
* Touches avec membrane de protection
* IP174-1 : une touche d’appel rapide
* IP174-4 : 4 touches d’appel rapide
* IP174 : clavier téléphonique à 12 touches
* Chaque modèle : 3 touches de mode d’appel (mains libres, appel direct/prioritaire, PTT), 2 touches de volume
* Indicateur d’appel
* Dimensions (L x P x H) : 130 x 70 x 303 mm
* Poids : env. 1500 g

===Interfaces===
* 10/100-BASE-TX (auto-négociation), RJ-45 (prise modulaire 8P8C)
* Alimentation externe PSU 24 V (entrée)
* Sortie 24 V DC (500 mA)
* Relais (NO/NC) (Normalement Ouvert/Normalement Fermé)
* Combiné (6 fils)
* Casque (6 fils) avec prise en charge PTT
* Haut-parleur externe
* Port USB arrière - usage interne uniquement

===Hardware===
* Alimentation : Power over Ethernet+ selon IEEE 802.3at, Classe 4
* 128 Mo de RAM, 16 Mo de mémoire Flash
* Température ambiante de fonctionnement : -25 °C à +70 °C
* Humidité ambiante : 10 % à 90 % (sans condensation)
* Température de stockage : -10 °C à +70 °C
{{Template:Leistungsmerkmale FR - Sprach Coder|G.722, Opus-NB, Opus-WB, G.729 (à partir de 15r1sr16/16r1sr4)}}
{{Template:Leistungsmerkmale FR - Voip Protokolle13}}
{{Template:Leistungsmerkmale FR - Netzwerk13}}

Tunnelisation PPTP avec jusqu’à 4 tunnels simultanés, chiffrement via MPPE
{{Template:Leistungsmerkmale FR - Administration13}}
===Fonctions supplémentaires===
* Touche mains libres, appels mains libres en full duplex
* Touche d’appel direct, intrusion full duplex vers un poste libre ou occupé (désactivable)
* Touche PTT (appuer pour parler), fonction interphone et utilisation PTT classique (mode muet du micro)
* Annonces de zone, en nombre illimité
{{Template:Leistungsmerkmale FR - Lizenzen Telefone}}
{{Template:CE-Decl_Phones|Conformités|voir fiche d'information séparée}}
===Numéro de commande IP174-1: 01-01741-001===
===Numéro de commande IP174-4: 01-01744-001===
===Numéro de commande IP174: 01-17415-001===
</div>
{{Template:Datasheet_footer|FR}}
[[Category:Fiche technique Phones FR|{{PAGENAME}}]]

Ficha técnica IP174

2026-10-08T11:19:35Z

Vsc:

{{datasheet_header|innovaphone IP174|Estación intercomunicadora}}
<div class="datasheets-mehrspaltig">
[[Image:IP174-x.png]]
===Firmware===
Este dispositivo funciona con la versión 16 o superior
===Carcasa===
* Montaje en pared
* Altavoz frontal de 80 mm, 4 Ohm, plástico
* Carcasa IP66 para uso expuesto, estanca al polvo y al agua, resistente a la niebla salina
* Teclas de membrana
* IP174-1: una tecla de marcación rápida
* IP174-4: 4 teclas de marcación rápida
* IP174: teclado telefónico de 12 teclas
* Cada modelo: 3 teclas de modo de llamada (manos libres, directo/prioridad, PTT), 2 teclas de volumen
* Indicador de llamada
* Dimensiones (An x P x Al): 130 x 70 x 303 mm
* Peso: aprox. 1500 g
===Interfaces===
* 10/100-BASE-TX (auto negotiation), RJ-45 (modular Jack 8P8C)
* Fuente de alimentación externa 24 V PSU (entrada)
* Salida 24 V DC (500 mA)
* Relé (NO/NC)
* Microteléfono (6 hilos)
* Auricular/cascos (6 hilos) con soporte PTT
* Altavoz externo
* Puerto USB trasero - solo para uso interno
===Hardware===
* Alimentación: “Power over Ethernet+” según IEEE 802.3at, Clase 4
* 128 MByte RAM, 16 MByte Flash
* Temperatura de funcionamiento: de -25 °C a +70 °C
* Humedad: del 10% al 90% (sin condensación)
* Temperatura de almacenamiento: de -10 °C a +70 °C
{{Template:Leistungsmerkmale ES - Sprach Coder|G.722, Opus-NB, Opus-WB, G.729 (a partir de 15r1sr16/16r1sr4)}}
{{Template:Leistungsmerkmale ES - Voip Protokolle13}}
{{Template:Leistungsmerkmale ES - Netzwerk13}}

Túnel PPTP de hasta 4 túneles simultáneos, cifrado mediante MPPE
{{Template:Leistungsmerkmale ES - Administration13}}
===Características adicionales===
* Tecla manos libres – llamadas manos libres full duplex
* Tecla Direct in – intrusión full duplex en libre u ocupado (puede desactivarse)
* Tecla PTT – uso talkback y PTT clásico (función de mute del micrófono)
* Anuncios por zonas – zonas ilimitadas
{{Template:Leistungsmerkmale ES - Lizenzen Telefone}}
{{Template:CE-Decl_Phones|Conformidades|véase hoja informativa separada}}
===Número de pedido IP174-1: 01-01741-001===
===Número de pedido IP174-4: 01-01744-001===
===Número de pedido IP174: 01-17415-001===
</div>
{{Template:Datasheet_footer|ES}}
[[Category:Fichas técnicas Phones ES|{{PAGENAME}}]]

Datasheet IP174

2026-10-08T11:19:13Z

Vsc:

{{datasheet_header|innovaphone IP174|Intercom station}}
<div class="datasheets-mehrspaltig">
[[Image:IP174-x.png]]
===Firmware===
Device operated with Version 16 and higher
===Housing===
* Wall mount
* Frontside Speaker-80mm, 4Ohm, plastic
* IP66 enclosure for exposed use, dust and water-tight, salt mist resistant
* Foiled keys
* IP174-1: one speed dial key
* IP174-4: 4 speed dial keys
* IP174: 12 key telephone dialpad
* Each model: 3 call mode keys (hands-free, direct/priority, PTT), 2 volume keys
* Call indicator
* Measurements (W x D x H): 130 x 70 x 303 mm
* Weight: ca. 1500 grams

===Interfaces===
* 10/100-BASE-TX (auto negotiation), RJ-45 (modular Jack 8P8C)
* 24V PSU external power supply (input)
* 24V DC output (500mA)
* Relay (NO/NC)
* Handset (6-wire)
* Headset (6-wire) PTT support
* External Speaker
* Rear USB port - internal use only

===Hardware===
* Power supply: „Power over Ethernet+“ according to IEEE 802.3at, Class 4
* 128MByte RAM, 16MByte Flash
* Operation temperature: -25 °C to +70 °C
* Humidity: 10% to 90% (not condensed)
* Storage temperature: -10 °C to +70 °C
{{Template:Leistungsmerkmale EN - Sprach Coder|G.722, Opus-NB, Opus-WB, G.729 (since 15r1sr16/16r1sr4)}}
{{Template:Leistungsmerkmale EN - Voip Protokolle13}}
{{Template:Leistungsmerkmale EN - Netzwerk13}}

PPTP Tunneling up to 4 tunnels simultaneously, encoding via MPPE
{{Template:Leistungsmerkmale EN - Administration13}}
===Supplementary Features===
* Hands free key – Full duplex handsfree calls
* Direct in key – Full duplex intrusion to idle or busy (can be disabled)
* PTT key – Talkback and classic PTT use (mic mute feature)
* Zone announcements – unlimited zones
{{Template:Leistungsmerkmale EN - Lizenzen Telefone}}
{{Template:CE-Decl_Phones|Conformities|see separate information sheet}}
===Order Number IP174-1: 01-01741-001===
===Order Number IP174-4: 01-01744-001===
===Order Number IP174: 01-17415-001===
</div>
{{Template:Datasheet_footer|EN}}
[[Category:Technical Data Phones EN|{{PAGENAME}}]]

Datenblatt IP174

2026-10-08T11:18:49Z

Vsc:

{{datasheet_header|innovaphone IP174|Gegensprechstelle}}
<div class="datasheets-mehrspaltig">
[[Image:IP174-x.png]]
===Firmware===
Gerät betreibbar ab Version 16r1 oder höher
===Gehäuse===
* Wandhalterung
* Frontlautsprecher–80 mm, 4Ohm, Kunststoff
* IP66-Gehäuse für den Einsatz im Freien, staub- und wasserdicht, salznebelbeständig
* Folientasten
* IP174-1: eine Kurzwahltaste
* IP174-4: 4 Kurzwahltasten
* IP174: 12-Tasten-Telefonwählfeld
* Jedes Modell: 3 Anrufmodustasten (Freisprechen, Direkt/Priorität, PTT), 2 Lautstärketasten
* Anrufanzeige
* Abmessungen (B x T x H): 130 x 70 x 303 mm
* Gewicht: ca. 1500 Gramm

===Schnittstellen===
* 10/100-BASE-TX (Auto-Negotiation), RJ-45 (modular Jack 8P8C)
* 24V PSU externes Netzteil (Eingang)
* 24-V-Gleichstromausgang (500 mA)
* Relais (NO/NC)
* Handapparat (6-adrig)
* Headset (6-adrig) PTT-Unterstützung
* Externer Lautsprecher
* USB-Anschluss auf der Rückseite – nur für den internen Gebrauch

===Hardware===
* Stromversorgung: „Power over Ethernet+“ nach IEEE 802.3at, Klasse 4
* 128 MB RAM, 16 MB Flash
* Betriebstemperatur: +5 °C bis +55 °C
* Luftfeuchtigkeit: 10 % bis 90 % (nicht kondensierend)
* Lagertemperatur: -10 °C bis +70 °C

{{Template:Leistungsmerkmale DE - Sprach Coder|G.722, Opus-NB, Opus-WB, G.729 (ab 15r1sr16/16r1sr4)}}
{{Template:Leistungsmerkmale DE - Voip Protokolle13}}
{{Template:Leistungsmerkmale DE - Netzwerk13}}

PPTP bis zu 4 Tunnel parallel, Verschlüsselung mit MPPE

{{Template:Leistungsmerkmale DE - Administration13}}
===Zusätzliche Leistungsmerkmale===
* Freisprechtaste – Vollduplex-Freisprechgespräche
* Direktwahltaste – Vollduplex-Eingriff bei Besetzt oder Nichtbesetzt (kann deaktiviert werden)
* PTT-Taste – Talkback und klassische PTT-Verwendung (Mikrofon-Stummschaltfunktion)
* Zonenansagen – unbegrenzte Anzahl von Zonen

{{Template:Leistungsmerkmale DE - Lizenzen Telefone}}

{{Template:CE-Decl_Phones|Konformitäten|siehe gesondertes Informationsblatt}}
===Bestellnummer IP174-1: 01-01741-001===
===Bestellnummer IP174-4: 01-01744-001===
===Bestellnummer IP174: 01-17415-001===
</div>
{{Template:Datasheet_footer|DE}}
[[Category:Technische Daten Phones DE|{{PAGENAME}}]]

Datenblatt IP172

2026-10-08T08:25:52Z

Vsc: /* Bestellnummer 01-00172-001 */

{{datasheet_header|innovaphone IP172|Industrielle Gegensprechstelle}}
<div class="datasheets-mehrspaltig">
[[Image:IP172.png]]
===Firmware===
Gerät betreibbar ab Version 16r1 oder höher
===Gehäuse===
* Wandhalterung
* Rückseitiger Lautsprecher–46 mm, 50Ohm, Kunststoff, für Klingelton
* IP66-Gehäuse für den Einsatz im Freien, staub- und wasserdicht, salznebelbeständig
* Folientasten
* 12-Tasten-Telefonwählfeld
* 3 Anrufmodustasten (Freisprechen, Direkt/Priorität, PTT), 2 Lautstärketasten
* Anrufanzeige
* Abmessungen (B x T x H): 130 x 70 x 303 mm
* Gewicht: ca. 1500 Gramm

===Schnittstellen===
* 10/100-BASE-TX (Auto-Negotiation), RJ-45 (modular Jack 8P8C)
* 24V PSU externes Netzteil (Eingang)
* 24-V-Gleichstromausgang (500 mA)
* Relais (NO/NC)
* Handapparat (6-adrig)
* Headset (6-adrig) PTT-Unterstützung
* Externer Lautsprecher
* USB-Anschluss auf der Rückseite – nur für den internen Gebrauch

===Hardware===
* Stromversorgung: „Power over Ethernet+“ nach IEEE 802.3at, Klasse 4
* 128 MB RAM, 16 MB Flash
* Betriebstemperatur: -25 °C bis +70 °C
* Luftfeuchtigkeit: 10 % bis 90 % (nicht kondensierend)
* Lagertemperatur: -10 °C bis +70 °C

{{Template:Leistungsmerkmale DE - Sprach Coder|G.722, Opus-NB, Opus-WB, G.729 (ab 15r1sr16/16r1sr4)}}
{{Template:Leistungsmerkmale DE - Voip Protokolle13}}
{{Template:Leistungsmerkmale DE - Netzwerk13}}

PPTP bis zu 4 Tunnel parallel, Verschlüsselung mit MPPE

{{Template:Leistungsmerkmale DE - Administration13}}
===Zusätzliche Leistungsmerkmale===
* Freisprechtaste – Vollduplex-Freisprechgespräche
* Direktwahltaste – Vollduplex-Eingriff bei Besetzt oder Nichtbesetzt (kann deaktiviert werden)
* PTT-Taste – Talkback und klassische PTT-Verwendung (Mikrofon-Stummschaltfunktion)
* Zonenansagen – unbegrenzte Anzahl von Zonen

{{Template:Leistungsmerkmale DE - Lizenzen Telefone}}

{{Template:CE-Decl_Phones|Konformitäten|siehe gesondertes Informationsblatt}}
===Bestellnummer: 01-00172-001===
</div>
{{Template:Datasheet_footer|DE}}
[[Category:Technische Daten Phones DE|{{PAGENAME}}]]

Datenblatt IP171

2026-10-08T08:25:40Z

Vsc: /* Bestellnummer 01-00171-001 */

{{datasheet_header|innovaphone IP171|Wandmontierte Gegensprechstelle}}
<div class="datasheets-mehrspaltig">
[[Image:IP171.png]]
===Firmware===
Gerät betreibbar ab Version 16r1 oder höher
===Gehäuse===
* Wandmontage
* Frontlautsprecher-60mm, 8Ohm, Kunststoff
* IP66-Gehäuse für den Einsatz im Freien, staub- und wasserdicht, salznebelbeständig
* OLED-Display, 128 x 64 Pixel
* Silikon-Funktionstasten mit Hintergrundbeleuchtung (3 x dynamisch zuweisbar, 3 x Navigation)
* Silikon-Tastatur mit Hintergrundbeleuchtung
* Silikon-Anrufmodustasten mit Hintergrundbeleuchtung (Freisprechen, Direkt/Priorität, PTT)
* Anrufanzeige
* Umgebungslichtsensor
* Abmessungen (B x T x H): 132 x 70 x 303 mm
* Gewicht: ca. 1500 Gramm

===Schnittstellen===
* 10/100-BASE-TX (Auto-Negotiation), RJ-45 (modular Jack 8P8C)
* 24V PSU externes Netzteil (Eingang)
* 24-V-Gleichstromausgang (500 mA)
* Relais (NO/NC)
* Handapparat (6-adrig)
* Headset (6-adrig) PTT-Unterstützung
* Externer Lautsprecher
* USB-Anschluss auf der Rückseite – nur für den internen Gebrauch

===Hardware===
* Stromversorgung: „Power over Ethernet+“ nach IEEE 802.3at, Klasse 4
* 128 MB RAM, 16 MB Flash
* Betriebstemperatur: +5 °C bis +55 °C
* Luftfeuchtigkeit: 10 % bis 90 % (nicht kondensierend)
* Lagertemperatur: -10 °C bis +70 °C

{{Template:Leistungsmerkmale DE - Sprach Coder|G.722, Opus-NB, Opus-WB, G.729 (ab 15r1sr16/16r1sr4)}}
{{Template:Leistungsmerkmale DE - Voip Protokolle13}}
{{Template:Leistungsmerkmale DE - Netzwerk13}}

PPTP bis zu 4 Tunnel parallel, Verschlüsselung mit MPPE

{{Template:Leistungsmerkmale DE - Administration13}}
===Zusätzliche Leistungsmerkmale===
* Freisprechtaste – Vollduplex-Freisprechgespräche
* Direktwahltaste – Vollduplex-Eingriff bei Besetzt oder Nichtbesetzt (kann deaktiviert werden)
* PTT-Taste – Talkback und klassische PTT-Verwendung (Mikrofon-Stummschaltfunktion)
* Zonenansagen – unbegrenzte Anzahl von Zonen

{{Template:Leistungsmerkmale DE - Lizenzen Telefone}}

{{Template:CE-Decl_Phones|Konformitäten|siehe gesondertes Informationsblatt}}
===Bestellnummer: 01-00171-001===
</div>
{{Template:Datasheet_footer|DE}}
[[Category:Technische Daten Phones DE|{{PAGENAME}}]]

Datenblatt IP170

2026-10-08T08:25:13Z

Vsc: /* Bestellnummer 01-00170-001 */

{{datasheet_header|innovaphone IP170|Unterputz Gegensprechstelle}}
<div class="datasheets-mehrspaltig">
[[Image:IP170.png]]
===Firmware===
Gerät betreibbar ab Version 16r1 oder höher
===Gehäuse===
* Unterputz Montage
* Frontlautsprecher-61mm, 4Ohm
* Schutzklasse IP20
* OLED-Display, 128 x 64 Pixel
* Silikon-Funktionstasten mit Hintergrundbeleuchtung (3 x dynamisch belegbar, 3 x Navigation)
* Silikon-Telefontastatur mit Hintergrundbeleuchtung
* Silikon-Anrufmodustasten mit Hintergrundbeleuchtung (Freisprechen, Direkt/Priorität, PTT)
* Anrufanzeige
* Umgebungslichtsensor
* Abmessungen (B x T x H): 94 x 31 x 269 mm
* Gewicht: ca. 650 Gramm

===Schnittstellen===
* 10/100-BASE-TX (Auto-Negotiation), RJ-45 (modular Jack 8P8C)
* 24V PSU externes Netzteil (Eingang)
* 24-V-Gleichstromausgang (500 mA)
* Relais (NO/NC)
* Handapparat (6-adrig)
* Headset (6-adrig) PTT-Unterstützung
* Externer Lautsprecher
* USB-Anschluss auf der Rückseite – nur für den internen Gebrauch

===Hardware===
* Stromversorgung: „Power over Ethernet+“ nach IEEE 802.3at, Klasse 4
* 128 MB RAM, 16 MB Flash
* Betriebstemperatur: +5 °C bis +55 °C
* Luftfeuchtigkeit: 10 % bis 90 % (nicht kondensierend)
* Lagertemperatur: -10 °C bis +70 °C

{{Template:Leistungsmerkmale DE - Sprach Coder|G.722, Opus-NB, Opus-WB, G.729 (ab 15r1sr16/16r1sr4)}}
{{Template:Leistungsmerkmale DE - Voip Protokolle13}}
{{Template:Leistungsmerkmale DE - Netzwerk13}}

PPTP bis zu 4 Tunnel parallel, Verschlüsselung mit MPPE

{{Template:Leistungsmerkmale DE - Administration13}}
===Zusätzliche Leistungsmerkmale===
* Freisprechtaste – Vollduplex-Freisprechgespräche
* Direktwahltaste – Vollduplex-Eingriff bei Besetzt oder Nichtbesetzt (kann deaktiviert werden)
* PTT-Taste – Talkback und klassische PTT-Verwendung (Mikrofon-Stummschaltfunktion)
* Zonenansagen – unbegrenzte Anzahl von Zonen

{{Template:Leistungsmerkmale DE - Lizenzen Telefone}}

{{Template:CE-Decl_Phones|Konformitäten|siehe gesondertes Informationsblatt}}
===Bestellnummer: 01-00170-001===
</div>
{{Template:Datasheet_footer|DE}}
[[Category:Technische Daten Phones DE|{{PAGENAME}}]]

Datenblatt IP111

2026-10-08T08:24:31Z

Vsc: /* Bestellnummer: 01-00111-001 */

{{datasheet_header|innovaphone IP111/IP111A/IP111-maritime|Allround-Telefon mit großem Farbdisplay & Funktionstasten}}
<div class="datasheets-mehrspaltig">
[[Image:IP11x.png|ip11x.png/]]
===Typen===
*IP111: mechanischer Gabelumschalter
*IP111A: sensorischer Gabelumschalter (ersetzt IP111, Start-MAC: 00-90-33-4f-42-af)
* IP111-maritime: DNV-GL zertifiziert
===Firmware===
* IP111: betreibbar mit Version 11 oder höher
* IP111A: betreibbar ab Versionen 11r2sr49, 12r1sr35, 12r2sr33 und 13r1sr8 oder höher; ab HW1501 mind. 13r3sr5

===Gehäuse===
Farbdisplay, 320 x 240 Pixel (3,5 Zoll)

Telefontastatur

2 x 6 Funktionstasten (durch Mehrfachnutzung 16 Funktions- und 32 Partnertasten dynamisch belegbar)

9 Spezialtasten

Maße: 21 x 15,5 x 3,5 cm (Basis), Wand- und Tischhalterung (reversible Montageplatte)

Gewicht: ca. 800 g

===Schnittstellen===
1 x Ethernet: 10/100-BASE-TX (auto negotiation), RJ-45 (modular Jack 8P8C) mit “Power over Ethernet” nach IEEE 802.3af

1 x Ethernet: 10/100-BASE-TX (auto negotiation), RJ-45 (modular Jack 8P8C) für PC Anbindung

Anschluss für externes Steckernetzteil
===Hardware===
Stromversorgung: externes Netzteil: 12 V, 6 W oder Power over Ethernet nach IEEE 802.3af, Class 1

128 MB DDR3, 16 MB Flash

{{Template:Leistungsmerkmale DE - Hardware Telefone}}

{{Template:Leistungsmerkmale DE - Sprach Coder|G.722, Opus-NB, Opus-WB, G.729 (ab 15r1sr16/16r1sr4)}}

{{Endgeräte_Firmware_Technische_Daten_DE}}
===Zusätzliche Leistungsmerkmale===
Freisprechen, Lauthören

{{Template:Leistungsmerkmale DE - Lizenzen Telefone}}

{{Template:CE-Decl_Phones|Konformitäten|siehe gesondertes Informationsblatt}}
===Bestellnummer IP111A: 01-00111-001===
===Bestellnummer IP111-maritime: 01-00111-003===
</div>
{{Template:Datasheet_footer|DE}}
[[Category:Technische Daten Phones DE|{{PAGENAME}}]]

Datenblatt IP174

2026-10-08T07:55:46Z

Vsc:

{{datasheet_header|innovaphone IP174|Gegensprechstelle}}
<div class="datasheets-mehrspaltig">
[[Image:IP174-x.png]]
===Firmware===
Gerät betreibbar ab Version 16r1 oder höher
===Gehäuse===
* Wandhalterung
* Frontlautsprecher–80 mm, 4Ohm, Kunststoff
* IP66-Gehäuse für den Einsatz im Freien, staub- und wasserdicht, salznebelbeständig
* Folientasten
* IP174-1: eine Kurzwahltaste
* IP174-4: 4 Kurzwahltasten
* IP174-15: 12-Tasten-Telefonwählfeld
* Jedes Modell: 3 Anrufmodustasten (Freisprechen, Direkt/Priorität, PTT), 2 Lautstärketasten
* Anrufanzeige
* Abmessungen (B x T x H): 130 x 70 x 303 mm
* Gewicht: ca. 1500 Gramm

===Schnittstellen===
* 10/100-BASE-TX (Auto-Negotiation), RJ-45 (modular Jack 8P8C)
* 24V PSU externes Netzteil (Eingang)
* 24-V-Gleichstromausgang (500 mA)
* Relais (NO/NC)
* Handapparat (6-adrig)
* Headset (6-adrig) PTT-Unterstützung
* Externer Lautsprecher
* USB-Anschluss auf der Rückseite – nur für den internen Gebrauch

===Hardware===
* Stromversorgung: „Power over Ethernet+“ nach IEEE 802.3at, Klasse 4
* 128 MB RAM, 16 MB Flash
* Betriebstemperatur: +5 °C bis +55 °C
* Luftfeuchtigkeit: 10 % bis 90 % (nicht kondensierend)
* Lagertemperatur: -10 °C bis +70 °C

{{Template:Leistungsmerkmale DE - Sprach Coder|G.722, Opus-NB, Opus-WB, G.729 (ab 15r1sr16/16r1sr4)}}
{{Template:Leistungsmerkmale DE - Voip Protokolle13}}
{{Template:Leistungsmerkmale DE - Netzwerk13}}

PPTP bis zu 4 Tunnel parallel, Verschlüsselung mit MPPE

{{Template:Leistungsmerkmale DE - Administration13}}
===Zusätzliche Leistungsmerkmale===
* Freisprechtaste – Vollduplex-Freisprechgespräche
* Direktwahltaste – Vollduplex-Eingriff bei Besetzt oder Nichtbesetzt (kann deaktiviert werden)
* PTT-Taste – Talkback und klassische PTT-Verwendung (Mikrofon-Stummschaltfunktion)
* Zonenansagen – unbegrenzte Anzahl von Zonen

{{Template:Leistungsmerkmale DE - Lizenzen Telefone}}

{{Template:CE-Decl_Phones|Konformitäten|siehe gesondertes Informationsblatt}}
===Bestellnummer IP174-1: 01-01741-001===
===Bestellnummer IP174-4: 01-01744-001===
===Bestellnummer IP174-12: 01-17415-001===
</div>
{{Template:Datasheet_footer|DE}}
[[Category:Technische Daten Phones DE|{{PAGENAME}}]]

Partner Apps

2026-10-08T06:00:37Z

Vsc: /* 3rdParty Terminal Device Provisioning */

myApps Partner applications

For an overview with brief description, refer to [https://www.innovaphone.com/en/products/software/overview-all-apps.html this page].

Please note that innovaphone itself does not provide any technical support for products and applications described here. This is exclusively provided by the third-party manufacturers themselves, who can be reached via the contact details mentioned in the articles.

===3rdParty Terminal Device Provisioning===
<DynamicPageList>
ordermethod = sortkey
mode = unordered
order = ascending
category = Partner Apps
category = 3rdParty Terminal Devices
</DynamicPageList>

===Alarm Server Solutions===
<DynamicPageList>
ordermethod = sortkey
mode = unordered
order = ascending
category = Partner Apps
category = 3rdParty Alarm Server
</DynamicPageList>
===App Development===
<DynamicPageList>
ordermethod = sortkey
mode = unordered
order = ascending
category = Partner Apps
category = 3rdParty App Development
</DynamicPageList>
===Call Recording===
<DynamicPageList>
ordermethod = sortkey
mode = unordered
order = ascending
category = Partner Apps
category = 3rdParty Recording
</DynamicPageList>
===Contact Center Applications===
<DynamicPageList>
ordermethod = sortkey
mode = unordered
order = ascending
category = Partner Apps
category = 3rdParty Contact Center Applications
</DynamicPageList>
===Cloud===
<DynamicPageList>
ordermethod = sortkey
mode = unordered
order = ascending
category = Partner Apps
category = 3rdParty Cloud
</DynamicPageList>
===Conferencing / Video Systems===
<DynamicPageList>
ordermethod = sortkey
mode = unordered
order = ascending
category = Partner Apps
category = 3rdParty Conferencing / Video Systems
</DynamicPageList>
===CTI and integrations===
<DynamicPageList>
ordermethod = sortkey
mode = unordered
order = ascending
category = Partner Apps
category = 3rdParty CTI and integrations
</DynamicPageList>
===Directory Services===
<DynamicPageList>
ordermethod = sortkey
mode = unordered
order = ascending
category = Partner Apps
category = 3rdParty Directory Services
</DynamicPageList>
===Music on Hold===
<DynamicPageList>
ordermethod = sortkey
mode = unordered
order = ascending
category = Partner Apps
category = 3rdParty_Music_on_Hold
</DynamicPageList>
===Network Equipment (SBCs)===
<DynamicPageList>
ordermethod = sortkey
mode = unordered
order = ascending
category = Partner Apps
category = 3rdParty Network Equipment
</DynamicPageList>
===Reporting / Monitoring===
<DynamicPageList>
ordermethod = sortkey
mode = unordered
order = ascending
category = Partner Apps
category = 3rdParty Reporting / Monitoring
</DynamicPageList>
===VoIPSystem Management===
<DynamicPageList>
ordermethod = sortkey
mode = unordered
order = ascending
category = Partner Apps
category = 3rdParty VoIPSystem Management
</DynamicPageList>

Howto:Snom Hospitality - Snom - Partner App

2026-10-08T06:00:25Z

Vsc: Vsc moved page Howto:Snom Hospitality - Snom - Partner App to Howto:Snom-Hospitality-Provisioning-App - Snom - Partner App: requested by manufacturer

#REDIRECT [[Howto:Snom-Hospitality-Provisioning-App - Snom - Partner App]]

Howto:Snom-Hospitality-Provisioning-App - Snom - Partner App

2026-10-08T06:00:25Z

Vsc: Vsc moved page Howto:Snom Hospitality - Snom - Partner App to Howto:Snom-Hospitality-Provisioning-App - Snom - Partner App: requested by manufacturer

[[Image:Snom logo gray 60.jpg|350px|right]]

==Product Name==
;
;
[https://service.snom.com/display/wiki/PhoneLink+for+innovaphone SNOM PhoneLink App]

==Certification Status==
;
{{Template:Compat_Status_referral_product_new|type=App}}

This App has been listed February 2024.

==Category==
;
;
;
[[Category:Partner_Apps|{{PAGENAME}}]]
{{Category:3rdParty_Terminal_Devices}}
[[Category:3rdParty_Terminal_Devices|{{PAGENAME}}]]

==Vendor==
;
;
[[Image:Snom logo gray 60.jpg|150px]]

;
;
Snom Technology GmbH is a leading provider of innovative telecommunication solutions, specializing in the design and manufacture of high-quality VoIP telephones and communication endpoints. 
With a strong focus on reliability, versatility, and user-friendly features, Snom has earned a reputation for delivering cutting-edge products tailored to meet the diverse needs of businesses and organizations worldwide. 
Committed to excellence and customer satisfaction, Snom continues to push the boundaries of communication technology, empowering businesses to connect, collaborate, and thrive in today's dynamic digital landscape. 
 
For further information refer to vendor website via link 
[https://www.snom.com Snom Technology GmbH]

==Description==
 
;
;

;
;
[[File:PhoneLink main screen.jpg|thumb]] 
PhoneLink for innovaphone, an auto-provisioning application designed to streamline the integration of Snom phones into innovaphone systems. 
This intuitive app allows innovaphone administrators to seamlessly add Snom phones using the familiar graphical interface of the innovaphone platform. 
With a straightforward installation process, Snom phones can be effortlessly integrated by simply entering their MAC address. 
 
 
Through seamless integration with the SRAPS REST API, adding the MAC address within the innovaphone PBX triggers the registration and provisioning configuration data for Snom devices. 
Upon booting up, each phone automatically retrieves its configuration from SRAPS, ensuring smooth setup and deployment. 
 
 
PhoneLink for innovaphone supports all compatible models from the D-Series, M-Series, MSC-Series, and C-Series, making it versatile for various device types that support auto-provisioning via SRAPS. 
This essential app is conveniently accessible through the innovaphone App Store, allowing for easy downloading and installation directly from the platform. 
 
 
Starting with PhoneLink app version 1337 we support multi SIP account generation on all Snom devices. 
All DECT devices no longer need manual configuration for all handsets.

==Functions==
;
;
;

;

===Multi-PBX ready===
Phone Link app can be used in Multi-PBX enviroment 
No special configuration, required 

===Cloud ready===
PhoneLink app is fully tested and compliant with innovaphon cloud enviroment 

=== Required API’s ===
;
;
;

* Websocket
* AdminApi
* TableUsers
* Services
* PbxApi (since SR1)

==Licensing==
No license required

==Prerequisites==
;
;
;

innovaphone PBX firmware version 13r2 or higher must be installed. 
The app platform must be correctly installed and accessible via its IP address. 
Users need an SRAPS user account and have created an API key to utilize the app's functionalities. 

;
[https://service.snom.com/display/wiki/PhoneLink+for+innovaphone Snom PhoneLink app.]

==Versions==
PhoneLink app version 1337 final or higher

===Compatible innovaphone firmware versions===
;
* innovaphone V14r1
* innovaphone V13r3
* innovaphone V13r2

===Application versions used for interop testing===
* PhoneLink app version 1337 final
* innovaphone V14r1
* innovaphone V13r3

==Configuration==
;
;
;

;
;

;

;
;
In the articles below we will present how to configure PhoneLink app and all types of Snom phones. 

===PhoneLink on innovaphone app store===
Step by step instruction describing how to configure PhoneLink app on innovaphone AP platform. 
[https://service.snom.com/display/wiki/How+to+install+PhoneLink+from+the+innovaphone+app+store How to install PhoneLink from the innovaphone app store]

'''Note''': After installing the PhoneLink app, the Profile app needs to get access to the PhoneLink app to offer Snom devices for provisioning. 
Specifically, respective Snom-application must be activated in the Profile app object on the PBX under the Apps tab.

===Desktop phone configuration with PhoneLink===
In this article we are showing how to provision Snom desk phones series: D140/150, D3xx, D7xx and D8xx. 
Howto covers phones with a single SIP account and multiple SIP accounts. 
[https://service.snom.com/display/wiki/Provisioning+Snom+desk+phones+with+innovaphone+pbx How to Provision a Snom deck phones on Innovaphone PBX]

===DECT systems configuration with PhoneLink===
In this article we are showing how to provision Snom DECT systems series: M110, M400, M900, M700 and M300. 
Howto covers multiple SIP accounts configuration required by DECT system. 
[https://service.snom.com/display/wiki/Provisioning+Snom+DECT+systems+with+innovaphone+pbx How to Provision a Snom DECT systems on Innovaphone PBX]

===Mass deployment with PhoneLink app.===
In this article we are showing how to use PhoneLink app. with Mass Deploymnet of the Snom phones 
Howto covers single and multiple SIP accounts mass deploymnet scenarios with all Snom devices. 
[https://service.snom.com/display/wiki/Mass+deployment+of+Snom+phones+with+innovaphone+pbx PhoneLink for innovaphone - Mass deployment PBX]

===LDAP directory configuration with PhoneLink app.===
In this article we are showing how to add extra features like LDAP configuration with PhoneLink app. 
[https://service.snom.com/display/wiki/LDAP+configuration+for+Snom+phones+with+innovaphone+pbx LDAP directory configuration using PhoneLink app.]

==Contact Details==
{|
| Company Name: || Snom Technology GmbH
|-
| Street: || Aroser Allee 66
|-
| ZIP/City: || 13407 Berlin Germany
|-
| Country: || Germany
|-
| Phone: || +49 30 39833-0
|-
| Fax: || +49 30 39833-111
|-
| Mail: || [mailto:officemanagement@snom.com officemanagement@snom.com]
|-
| Internet: || [https://www.snom.com Snom Technology GmbH]
|-
| Contact: || [https://www.snom.com/de/kontakt/ Snom contact]
|-
| Support: || [https://service.snom.com Snom Service Hub]
|}

Howto:Fanvil IP Phones-Fanvil-3rd Party Product

2026-09-29T06:39:50Z

Vsc:

{{FIXME|reason=This article is currently under work. As long, as this disclaimer is displayed, information may change.}}

[[File:Fanvil Logo.png|alt=v66_pro.png/|right|200x200px|fanvil_logo.png/|fanvil_logo.png/]]

==Product Name== 
[https://www.fanvil.com/products/p1/index.html Fanvil IP Phones]

== Certification Status == 

==Category==
[[Category:Referral Product|{{PAGENAME}}]]
{{Category:3rdParty_Terminal_Devices}}
[[Category:3rdParty Terminal Devices|{{PAGENAME}}]]

==Vendor==  
Fanvil Technology Co., Ltd. (Fanvil) is a leading global provider of Audio&Video-IoT (A&V-IoT) devices. With three R&D centers in Beijing, Shenzhen, and Suzhou, China, Fanvil has compiled an effective team of R&D, production, sales, and service staff to innovate and add value to our business partners. As the pioneer in applying standardized network communication technology and Audio&Video technologies to build A&V-IoT, Fanvil is boosting the digital transformation for multiple industries.

[[File:Fanvil Logo.png|fanvil_logo.png/|fanvil_logo.png/]]

== Description ==     
{|
| colspan="6" |'''Desk phones'''
|
|-
| colspan="5" |'''V Series IP Phone'''
|
|
|-
|'''V66'''
|'''V66 Pro'''
|'''V65'''
|'''V64'''
|
|
|
|-
|[[File:V66-前视图-英文-241014.png|left|frameless|260x260px|xn--v66---241014-hi6to93c0n5cjm7fpjya.png/|xn--v66---241014-hi6to93c0n5cjm7fpjya.png/]]
|[[File:V66 -Pro.png|left|frameless|303x303px|v66_-pro.png/|v66_-pro.png/]]
|[[File:V65.png|left|frameless|349x349px|v65.png/|v65.png/]]
|[[File:V64.png|left|frameless|349x349px|v64.png/|v64.png/]]
|
|
|
|-
|V66 features a 7-inch high-definition adjustable color touch screen

* Antibacterial material of the handset and keypad surface effectively inhibits more than 99.5%of bacteriagrowth.
* 7” adjustable color touch screen ( 0° to 40 °) for different lighting environments.
* Supports H.264 1080p video decoding, allowing users to monitor the status of the other party in real-timeduringthecall.
* Support audio codec G.722 and Opus, HD audio on speakerphone and handset
* Support 6-way Audio Conference.
* Built-in 2.4GHz/5GHz dual-band Wi-Fi and supports Wi-Fi 6 and Bluetooth 5.4, realizing more flexible connectivity
* Up to 116(29*4) DSS keys, every DSS key can be set as Line/BLF/ Speed Dial Key).

[https://www.fanvil.com/upload/files/20250320/1118hx24jr.pdf V66 Datasheet]
|V66 Pro is a color-screen business phone integrating audio

* Antibacterial material of the handset and keypad surface effectively inhibits more than 99.5%of bacteriagrowth.
* 7” adjustable color touch screen ( 0° to 40 °) for different lighting environments.
* Supports H.264 1080p video decoding, allowing users to monitor the status of the other party in real-timeduringthecall.
* Support audio codec G.722 and Opus, HD audio on speakerphone and handset.
* Support 6-way Audio Conference.
* Built-in 2.4GHz/5GHz dual-band Wi-Fi and supports Wi-Fi 6 and Bluetooth 5.4
* Up to 116(29*4) DSS keys, every DSS key can be set as Line/BLF/

[https://www.fanvil.com/upload/files/20250320/1119b88p26.pdf V66 Pro Datasheet]
|As the prime business phone featuring an adjustable screen

* Antibacterial material of the handset and keypad surface effectively inhibits more than 99.5%of bacteriagrowth.
* 4.3-inch (480x272) adjustable screen ( 0° to 40 °) for different lighting environments.
* Be able to receive video calls with video codec H.264.
* Available to link with security products, can be easily customized into various security solutions for reducinginvestment.
* Support audio codec G.722 and Opus, HD audio on speakerphone and handset.
* Support 6-way Audio Conference.
* Built-in 2.4GHz/5GHz Wi-Fi and Bluetooth 4.2, realizing more flexible connectivity.
* Up to 45 DSS keys, every DSS key can be set as Line/BLF/ Speed Dial Key).

[https://www.fanvil.com/upload/files/20241231/16324f6l4f.pdf V65 Datasheet]
|As the prime business phone featuring a 3.5-inch480x320colorLCD screen

* 3.5-inch color LCD screen.
* Support audio codec G.722 and Opus, HD audio on speakerphone and handset.
* Support 6-way Audio Conference.
* Built-in 2.4GHz/5GHz Wi-Fi and Bluetooth 4.2, realizing more flexible connectivity.
* Dual Gigabit ports, integrated PoE.
* Two installation methods of desktop stand and wall mountable.
* Up to 21 DSS keys, every DSS key can be set as Line/BLF/
[https://www.fanvil.com/upload/files/20241231/1632p2288z.pdf V64 Datasheet]
|
|
|
|-
|'''V63'''
|'''V62G'''
|'''V62W'''
|'''V62 Pro'''
|
|
|
|-
|[[File:V63.png|left|frameless|349x349px|v63.png/|v63.png/]]
|[[File:V62W.png|left|frameless|323x323px|v62w.png/|v62w.png/]]
|[[File:V62W.png|frameless|323x323px|v62w.png/|v62w.png/]]
|[[File:V62 Pro.png|left|frameless|323x323px|v62_pro.png/|v62_pro.png/]]
|
|
|
|-
|As the prime business phone featuring 2.8 color screen

* 2.8-inch color screen.
* Support audio codec G.722 and Opus, HD audio on speakerphone and handset.
* Support 6-way audio conference.
* Dual Gigabit ports, integrated PoE.
* Two installation methods of desktop stand and wall mountable.
* Up to 21 DSS keys, every DSS key can be set as Line/BLF/
[https://www.fanvil.com/upload/files/20241231/16334jp4xp.pdf V63 Datasheet]
|Fanvil V62G is a stylish and user-friendly IP phone.

* 2.8-inch 320x240 pixel color screen.
* Up to 21 DSS keys, every DSS key can be set as Line/BLF/ Speed Dial Key.
* Support audio codec G.722 and Opus, HD audio on speakerphone and handset.
* Support 6-way audio conference.
* Support EHS headset.
* Dual Gigabit ports, integrated PoE.
* Two installation methods of desktop stand and wall mountable.

[https://www.fanvil.com/upload/files/20241231/1633644464.pdf V62G Datasheet]
|Fanvil V62W is a stylish and user-friendly IP phone.

* 2.8-inch 320x240 pixel color screen.
* Up to 21 DSS keys, every DSS key can be set as Line/BLF/ Speed Dial Key.
* Support audio codec G.722 and Opus
* HD audio on speakerphone and handset.
* Support 6-way audio conference.
* Support EHS headset.
* Dual Gigabit ports, integrated PoE.
* Built-in 2.4GHz/5GHz Wi-Fi, supporting Wi-Fi 6.
* Built-in Bluetooth 5.4, supporting Bluetooth wireless headset.
* Two installation methods of desktop stand and wall mountable.

[https://www.fanvil.com/upload/files/20241231/1633j0xztz.pdf V62W Datasheet]
|Fanvil V62 Pro is an essential business IP phone that features a HD color screen

* 2.8-inch 320x240 pixel color screen.
* Up to 21 DSS keys, every DSS key can be set as Line/BLF/ Speed Dial Key.
* Support audio codec G.722 and Opus, HD audio on speakerphone and handset. S
* upport 6-way audio conference .
* Support EHS headset.
* Dual Gigabit ports, integrated PoE.
* Bluetooth wireless handset provides an excellent audio experience for instantly connected, open workspaces.
* Two installation methods of desktop stand

[https://www.fanvil.com/upload/files/20250327/09488lv6x2.pdf V62 Pro Datasheet]
|
|
|
|-
|'''V61G'''
|'''V61W'''
|'''V60P'''
|'''V50P'''
|
|
|
|-
|[[File:V61G.png|frameless|323x323px|v61g.png/|v61g.png/]]
|[[File:V61G.png|frameless|323x323px|v61g.png/|v61g.png/]]
|[[File:V60P.png|frameless|323x323px|v60p.png/|v60p.png/]]
|[[File:V50p.png|frameless|218x218px|v50p.png/|v50p.png/]]
|
|
|
|-
|Fanvil V61G is a stylish and user-friendly IP phone. It features a 2.4-inch (320x240) high-definitioncolorscreen

* 2.4-inch 320x240 pixel color screen.
* Support audio codec G.722 and Opus
* HD audio on speakerphone and handset.
* Support 6-way audio conference.
* Dual Gigabit ports, integrated PoE.
* Up to 12 DSS keys, every DSS key can be set as Line/BLF/ Speed Dial Key.

[https://www.fanvil.com/upload/files/20250416/1143v42zf8.pdf V61G Datasheet]
|Fanvil V61W is a stylish and user-friendly IP phone. It features a 2.4-inch (320x240) high-definitioncolorscreen

* 2.4-inch color screen.
* Support audio codec G.722 and Opus, HD audio on speakerphone and handset.
* Support 6-way Audio conference.
* Available to link with security products, can be easily customized into various security solutions for reducinginvestment.
* Dual Gigabit ports, integrated PoE.
* Built-in 2.4GHz/5GHz Wi-Fi, supporting Wi-Fi 6. Built-in Bluetooth 5.4, supporting Bluetooth wireless headset .
* Up to 12 DSS keys, every DSS key can be set as Line/BLF/

[Https://www.fanvil.com/upload/files/20250416/1143020606.pdf V61W Datasheet]
|Fanvil V60P is a sleek and reliable basic-level IP phone. It features a 2.4-inch (320x240) color screen

* 2.4-inch color screen.
* Support audio codec G.722 and Opus
* HD audio on speakerphone and handset.
* Support 6-way Audio Conference.
* Fast Ethernet - 10/100Mbps Ethernet, integrated PoE.
* HAC HD voice handset
* Compatible with EHS headset.

[Https://www.fanvil.com/upload/files/20241231/13562240j2.pdf V60P Datasheet]
|V50P is a stylish, high-performance entry-level IP phone with a 2.3-inch 132x64 pixel dot-matrixscreen

* 2.3-inch 132x64 pixel dot-matrix screen
* Support audio codec G.722 and Opus, HD audio on speakerphone and handset
* Support 6-way Audio Conference
* Fast Ethernet - 10/100Mbps Ethernet, integrated PoE
* HAC HD voice handset
* Two installation methods of desktop stand and wall mountable
* Compatible with EHS headset

[https://www.fanvil.com/upload/files/20241231/1352hfr48l.pdf V50P Datesheet]
|
|
|
|-
| colspan="3" |'''LINKVlL Wireless UC Products'''
|
|
|
|
|-
|'''W610W'''
|'''W611W'''
|'''W620W'''
|
|
|
|
|-
|[[File:Fanvil W610W.png|left|frameless|323x323px|fanvil_w610w.png/|fanvil_w610w.png/]]
|[[File:W611W-V2.png|frameless|218x218px|center|w611w-v2.png/|w611w-v2.png/]]
|[[File:Fanvil W620W.png|frameless|218x218px|center|fanvil_w620w.png/|fanvil_w620w.png/]]
|
|
|
|
|-
|LINKVIL W610W is a portable enterprise-grade Wi-Fi IP phone

* 2" 240x320 color screen with intuitive user interface
* Built-in dual-band Wi-Fi (2.4G/5G)
* Incoming call vibration
* Up to 16 DSS keys, quick access to basic functions
* Built-in Bluetooth 5.0 can be used to connect wireless earphone
* No operation screen after 10 seconds during a call
* One configurable push-to-talk (PTT) button for quick dial, quick intercom, and quick multicast
* Up to 9 hours' talk time and up to 200 hours standby time
* The data is based on the laboratory test

[https://www.fanvil.com/upload/files/20240828/1005x8bj8j.pdf W610W Datasheet]
|LINKVIL W611W is a portable, elegant Wi-Fi
phone, certified to IP67 standard

* 2.4" 240x 320 color screen
* High protection level of IP67, which is waterproof, dustproof, and drop-safe from
* 1.8-meter height
* Up to 16 DSS keys, quick access to basic functions
* Support sidetone function
* Incoming call vibration
* Support dual-band Wi-Fi 802.11 a/b/g/n/ac/ax (Wi-Fi 6, 2.4G & 5G)
* Built-in Bluetooth 5.0
* Support gravity sensor and the screen will be on when the phone is raised or put down during a call
* One configurable push-to-talk (PTT) button for quick dial, quick intercom, and quick multicast
* Up to 9 hours' talk time and up to 200 hours standby time
* The data is based on the laboratory test

[https://www.fanvil.com/upload/files/20241231/165824z6d0.pdf W611W Datasheet]
|LINKVIL W620W is a portable enterprise-grade Wi-Fi IP phone

* 2.4" 240x320 color screen
* Supports H.264 4CIF video decoding
* Built-in dual-band Wi-Fi 6 (2.4GHz/5GHz) delivers
* HD audio with noise reduction
* Support incoming call vibration
* Drop-safe from 1.8-meter height
* Built-in Bluetooth 5.0
* Support 16 DSS Keys, 1 Programmable Key and 1 PTT key
* Up to 13 hours' talk time and up to 240 hours standby time
* The data is based on the laboratory test

[https://www.fanvil.com/upload/files/20250828/0957fn66h0.pdf W620W Datasheet]
|
|
|
|
|-
| colspan="4" |'''XU Series IP Phone'''
|
|
|
|-
|'''X6U V2'''
|'''X5U V2'''
|'''X4U V2'''
|'''X210-V2'''
|
|
|
|-
|[[File:X6U 主视图 (2).png|frameless|227x227px|xn--x6u__(2)-9g0mr73eyv1k.png/|xn--x6u__(2)-9g0mr73eyv1k.png/]]
|[[File:X5U Pro.png|frameless|226x226px|x5u_pro.png/|x5u_pro.png/]]
|[[File:X4U Pro.png|frameless|226x226px|x4u_pro.png/|x4u_pro.png/]]
|[[File:X210-V2.png|frameless|287x287px|x210-v2.png/|x210-v2.png/]]
|
|
|
|-
|X6U V2 is an enterprise IP Phone featuring main color screen and two extended screens IP Phone

* 4.3-inch main color screen and 2.4-inch extended screen for DSS keys.
* HD audio on speaker phone and handset.
* Support 6-way audio conference.
* 5 Line keys on the main display.
* 12 DSS keys on the extended screen, up to 60 DSS keys via 5 pages.
* Built-in Bluetooth 4.2, support Bluetooth headset; support Wi-Fi Dongle.
* Support EHS wireless headset.
* Dual Gigabit ports, integrated PoE.
* Stand with 2adjustable angles of 45 and 50 degrees.

[https://www.fanvil.com/upload/files/20241231/1642066v20.pdf X6U V2 Datesheet]
|X5U V2 is an enterprise IP Phone featuring 3.5-inch main color screen and 2.4-inch extended screen

* 3.5-inch main color screen and 2.4-inch extended screen for DSS keys.
* HD audio on speakerphone and handset.
* Support 6-way audio conference.
* 4 Line keys on the main display.
* 6 DSS keys on the extended screen, up to30 DSS keys via 5 pages.
* Built-in Bluetooth 4.2, support Bluetooth headset; support Wi-Fi Dongle.
* Support EHS wireless headset.
* Dual Gigabit ports, integrated PoE.
* Stand with 2adjustable angles of 45 and 50 degrees.

[https://www.fanvil.com/upload/files/20241231/16422rdvb8.pdf X5U V2 Datasheet]
|X4U V2 is an enterprise IP Phone featuring 2.8-inch main color screen and 2.4-inch extended screen.

* HD audio on speakerphone and handset.
* Support 6-wayaudio conference.
* 3 Line keys on the main display.
* 6 DSS keys on the extended screen, up to30 DSS keys via 5 pages.
* Support EHS wireless headset, Wi-Fi Dongle or BT Dongle.
* Dual Gigabit ports, integrated PoE.
* Stand with 2adjustable angles of 45 and 50 degrees.

[https://www.fanvil.com/upload/files/20241231/1643j08zf6.pdf X4U V2 Datasheet]
|Fanvil X210 enterprise IP phone is designed for business managers and busy office professionals

* 4.3-inch main color display, 2x3.5-inch side color displays for DSS keys.
* 20 SIP lines, hotspot.
* HD audio on speakerphone and handset.
* Built-in Bluetooth 4.2.
* Wi-Fi connectivity (Via Wi-Fi Dongle).
* 6-way audio conference.
* Up to 106 DSS keys (42 tri-colored physical keys).
* Video Codec H.264 support for receiving video calls.
* Dual Gigabit ports, integrated PoE.
* Stand with 2 adjustable angles of 40 and 50 degrees.

[https://www.fanvil.com/upload/files/20220913/0936prbthv.pdf X210-V2 Datasheet]
|
|
|
|-
|
|
|
|
|
|
|
|-
| colspan="5" |'''H Series Hotel IP Phone'''
|
|
|-
|'''H2U-V2'''
|'''H2U-V2 Red'''
|
|
|
|
|
|-
|[[File:H2U-V2.png|center|frameless|218x218px|h2u-v2.png/|h2u-v2.png/]]
|[[File:H2U red.png|left|frameless|218x218px|h2u_red.png/|h2u_red.png/]]
|
|
|
|
|
|-
|Fanvil H2U-V2 compact IP phone possesses brand features including 2 SIP lines, 10 speed dial keys, 1 programmable DSS key and a HD speaker on handset.

* Delicate and fashion outlook.
* Easy installation and configuration.
* Cost-effective model & Environmental friendly design. 10 speed dial keys, long press numeric keypad to achieve speed dial
* 1 programmable DSS key.
* 10/100Mbps Ethernet, support PoE power supply.
* Support the install mode of desktop or wall-mounted

[https://www.fanvil.com/upload/files/20230727/1447j6znl2.pdf H2U-V2 Datasheet]
|Fanvil H2U-V2 Red 4 buttons compact IP phone possesses brand features including 2 SIP lines, 4 speed dial keys, and a HD speaker on handset.

* Delicate and fashion outlook.
* Easy installation and configuration.
* 4 speed dial keys
* 10/100Mbps Ethernet, support PoE power supply.
* Support the install mode of desktop or wall-mounted
|
|
|
|
|
|}
== Functions == 

* Answer incoming call '''=yes'''
* Initiate outgoing call '''=yes'''

* Hold/Retrieve '''=yes'''
* Transfer '''=yes'''
* Call waiting'''= yes'''
* Do not disturb '''= yes'''
* Call Conference '''= yes'''
* Call Park'''= yes'''
* Message WaitingIndicator- status'''= yes'''
* Call Forward and divert'''= yes'''
* Intercom (HS to HS) '''= yes'''
* Called, calling, and connected party information'''= yes'''
* Missed-call notification'''= yes'''
* 1-touch speed dial'''= yes'''
* Redial '''= yes'''
* Background Upgrades'''=yes'''
* Zero touch provisioning, management, configuration and remote debugging '''= yes'''
* BLF '''= yes'''

== innovaphone CTI ready == 

* Initiate outgoing call (automatic call with no manual intervention, update of called party, correct call direction in call list) '''=yes'''
* Answer incoming call '''=yes'''
* Hold/Retrieve '''=yes'''
* Transfer '''=yes'''

== innovaphone Reverse Proxy ready == 

* STUN'''=yes'''
* SIP/TCP '''=yes'''
* SIP/TLS '''=yes'''

== innovaphone WebRTC ready == 

* Codec G.711'''=yes'''
* Codec OPUS '''=yes'''

== Supported Codecs ==

* G.722 '''=yes'''
* G.711 A-law '''=yes'''
* G.711 y-law '''=yes'''
* G.723.1 (53) '''=yes'''
* G.729A '''=yes'''
* Opus '''=yes'''

== DTMF Support == 

* SIP v1 (RFC2543), v2 (RFC3261)
* DTMF: In-band, Out-of-band(RFC 2833) and SIP INFO

== Supports RFC3261 Digest Authentication Scheme (Section 22.4) == 

* Supports RFC3261 Digest Authentication Scheme (Section 22.4) '''=yes'''

== Support LDAP Phonebook == 

* Support LDAP Phonebook'''=yes'''

== Version ==  
Product versions used for interop testing:

X4U V2,X5U V2,X6U V2,X210 V2 [https://www.fanvil.com/downfile.aspx?filepath=https://download.fanvil.com/Firmware/Release/XU-V2/X6U-V2/20250424/x6upro-fanvil-release-ff01-6916-2.12.22.2-krnlvUT2025-04-16-20.44.13.z&filename=x6upro-fanvil-release-ff01-6916-2.12.22.2-krnlvUT2025-04-16-20.44.13.z 2.12.22.2]

V50P [https://www.fanvil.com/downfile.aspx?filepath=https://download.fanvil.com/Firmware/Release/V50/20250703/v50p-fanvil-release-6981-2.12.20.17-kavlT2025-06-25-16.56.49.z&filename=v50p-fanvil-release-6981-2.12.20.17-kavlT2025-06-25-16.56.49.z 2.12.20.17]

V60P,V61G,V61W,V62G,V62W,V62ProV63,V64 [https://www.fanvil.com/downfile.aspx?filepath=https://download.fanvil.com/Firmware/Release/V6x/20250703/v6x-unified-release-a006-2.12.20.19-krvnlUT2025-06-25-16.41.51.z&filename=v6x-unified-release-a006-2.12.20.19-krvnlUT2025-06-25-16.41.51.z 2.12.20.19]

V65 [https://www.fanvil.com/downfile.aspx?filepath=https://download.fanvil.com/Firmware/Release/V65/20250428/v65-fanvil-release-5924-2.12.22.2-krnvlT2025-04-16-21.04.39.z&filename=v65-fanvil-release-5924-2.12.22.2-krnvlT2025-04-16-21.04.39.z 2.12.22.2]

V66, V66Pro [https://www.fanvil.com/downfile.aspx?filepath=https://download.fanvil.com/Firmware/Release/V66V66Pro/20250718/v66pro-fanvil-release-5927-2.12.20.7-krnvlT2025-07-15-13.51.47.z&filename=v66pro-fanvil-release-5927-2.12.20.7-krnvlT2025-07-15-13.51.47.z 2.12.20.7]

H2U-V2 [https://www.fanvil.com/downfile.aspx?filepath=https://download.fanvil.com/Firmware/Release/H2U-V2/20250519/h2u-v2-fanvil-release-ff01-5946-2.12.20.2-krnlvUT2025-02-14-14.27.56.z&filename=h2u-v2-fanvil-release-ff01-5946-2.12.20.2-krnlvUT2025-02-14-14.27.56.z 2.12.20.2]

H2U-V2 Red [https://drive.google.com/file/d/1gJq8SW5CYl6OL6tiI_wAuxjkS_4LcPjs/view?usp=drive_link 2.12.2.5]

W611W [https://www.fanvil.com/downfile.aspx?filepath=https://download.fanvil.com/Firmware/Release/Linkvil/W611W/20250918/w611-linkvil-release-ff01-9001-2.14.4-UkrnlvUT2025-09-17-03.35.46.z&filename=w611-linkvil-release-ff01-9001-2.14.4-UkrnlvUT2025-09-17-03.35.46.z 2.14.4]

W620W [https://www.fanvil.com/downfile.aspx?filepath=https://download.fanvil.com/Firmware/Release/Linkvil/W620W/w620w-Linkvil-release-9011-a00e-2.16.19-UkrvT2025-09-12-10.15.22.z&filename=w620w-Linkvil-release-9011-a00e-2.16.19-UkrvT2025-09-12-10.15.22.z 2.16.19]

* 3rd-Pty-Product Version: Latest firmwares from [https://www.fanvil.com/service/doc/index.html Fanvil] are preferred.
* innovaphone V12r2sr24

== Configuration ==    
'''Fanvil IP phone supports multiple SIP configurations'''

'''Phone Web Configuration:'''

a. Press “Down” Buttom when your phone on idle interface, you can get the IP address of the phone, input it to your PC browser.

b. The factory account password of the telephone is admin/admin. Then you can enter the Phone Configuration Interface

1.Login to phone web portal:

[[File:Web login.png|195x195px|center|frameless|web_login.png/|web_login.png/]]

2.Network setting:
[[File:Stun.png|center|frameless|stun.png/|stun.png/]]3.Account setting：
[[File:Sip.png|center|frameless|sip.png/|sip.png/]]

4.Register successful
[[File:Registered1.png|center|frameless|registered1.png/|registered1.png/]]

'''Use configuration files:'''

Fanvil IP phones can be deployed locally or remotely by creating a CFG file and importing the phones in different ways. Please see more details from our knowledge base: [https://kb.fanvil.com/#/model?label=Desk%20Phone&dirid=6710c699757fbc8ae6e46d55&itemId=68061044f619472daa36dafa&level=2 Fanvil Knowledge Base]

'''Configuration file template'''

As we said before, you can create a CFG file and import it to your phone to make all setting done. And here is an example for your reference:
{|
|+
|################################################################################
net.WANTYPE = 0

net.dhcp.Enabled = 1

net.dhcp.AutoDNS = 1

net.dhcp.AutoSNTP = 0

net.dhcp.DHCPOption100-101 = 1

net.dhcp.UseVerndorClassID = 0

net.dhcp.Hostname = Model

net.dhcp.VendorClassID = Fanvil Model

sip.line.1.AlwaysFWDNum =

sip.line.1.BusyFWDNum =

sip.line.1.NoAnswerFWDNum =

sip.line.1.FWDTimer = 5

sip.line.1.HotlineNum =

sip.line.1.HotlineEnabled = 0

sip.line.1.HotlineTimeout = 0

web.WebPort = 80

web.HttpsWebPort = 443

web.LogonTimeout = 15

web.account.1.Name = admin

<nowiki>###</nowiki>web.account.1.Password = (your password)

web.account.1.Level = 10

web.account.2.Name = guest

<nowiki>###</nowiki>web.account.2.Password = (your password)

web.account.2.Level = 5
|}

'''Any question please contact us'''

Support: [https://kb.fanvil.com/#/home https://kb.fanvil.com]

== Contact == 
{|
|CompanyName Fanvil Link Technology Co., Ltd.
|-
|Street 13th Floor, Building 2, Runzhi R&D Center, Xin'an Street, Bao'an District, Shenzhen, China
|-
|ZIP City Shenzhen
|-
|<nowiki>Tel:0086-0755-26402199</nowiki>
|-
|Mail: [mailto:contactname@companyname sales@fanvil.com]
|-
|Support: [mailto:contactname@companyname support@fanvil.com]
|}
For any questions please refer to [https://www.fanvil.com/contactus/index.html our contact page].
[[Category:Howto|{{PAGENAME}}]]

Partner Apps

2026-09-28T14:44:07Z

Vsc:

myApps Partner applications

For an overview with brief description, refer to [https://www.innovaphone.com/en/products/software/overview-all-apps.html this page].

Please note that innovaphone itself does not provide any technical support for products and applications described here. This is exclusively provided by the third-party manufacturers themselves, who can be reached via the contact details mentioned in the articles.

===3rdParty Terminal Device Provisioning===
<DynamicPageList>
ordermethod = sortkey
mode = unordered
order = ascending
category = Partner Apps
category = 3rdParty Terminal Devices
</DynamicPageList>
===Alarm Server Solutions===
<DynamicPageList>
ordermethod = sortkey
mode = unordered
order = ascending
category = Partner Apps
category = 3rdParty Alarm Server
</DynamicPageList>
===App Development===
<DynamicPageList>
ordermethod = sortkey
mode = unordered
order = ascending
category = Partner Apps
category = 3rdParty App Development
</DynamicPageList>
===Call Recording===
<DynamicPageList>
ordermethod = sortkey
mode = unordered
order = ascending
category = Partner Apps
category = 3rdParty Recording
</DynamicPageList>
===Contact Center Applications===
<DynamicPageList>
ordermethod = sortkey
mode = unordered
order = ascending
category = Partner Apps
category = 3rdParty Contact Center Applications
</DynamicPageList>
===Cloud===
<DynamicPageList>
ordermethod = sortkey
mode = unordered
order = ascending
category = Partner Apps
category = 3rdParty Cloud
</DynamicPageList>
===Conferencing / Video Systems===
<DynamicPageList>
ordermethod = sortkey
mode = unordered
order = ascending
category = Partner Apps
category = 3rdParty Conferencing / Video Systems
</DynamicPageList>
===CTI and integrations===
<DynamicPageList>
ordermethod = sortkey
mode = unordered
order = ascending
category = Partner Apps
category = 3rdParty CTI and integrations
</DynamicPageList>
===Directory Services===
<DynamicPageList>
ordermethod = sortkey
mode = unordered
order = ascending
category = Partner Apps
category = 3rdParty Directory Services
</DynamicPageList>
===Music on Hold===
<DynamicPageList>
ordermethod = sortkey
mode = unordered
order = ascending
category = Partner Apps
category = 3rdParty_Music_on_Hold
</DynamicPageList>
===Network Equipment (SBCs)===
<DynamicPageList>
ordermethod = sortkey
mode = unordered
order = ascending
category = Partner Apps
category = 3rdParty Network Equipment
</DynamicPageList>
===Reporting / Monitoring===
<DynamicPageList>
ordermethod = sortkey
mode = unordered
order = ascending
category = Partner Apps
category = 3rdParty Reporting / Monitoring
</DynamicPageList>
===VoIPSystem Management===
<DynamicPageList>
ordermethod = sortkey
mode = unordered
order = ascending
category = Partner Apps
category = 3rdParty VoIPSystem Management
</DynamicPageList>

Howto:PhoneLink - Snom - Partner App

2026-09-28T14:43:23Z

Vsc: Vsc moved page Howto:PhoneLink - Snom - Partner App to Howto:Snom PhoneLink - Snom - Partner App: adapted title as both Snom and Gigaset applications are using manufacturer name within product name

#REDIRECT [[Howto:Snom PhoneLink - Snom - Partner App]]

Howto:Snom PhoneLink - Snom - Partner App

2026-09-28T14:43:23Z

Howto:Hospitality - Snom - Partner App

2026-09-28T14:43:09Z

Vsc: Vsc moved page Howto:Hospitality - Snom - Partner App to Howto:Snom Hospitality - Snom - Partner App: adapted title as both Snom and Gigaset applications are using manufacturer name within product name

#REDIRECT [[Howto:Snom Hospitality - Snom - Partner App]]

Howto:Snom-Hospitality-Provisioning-App - Snom - Partner App

2026-09-28T14:43:09Z

Partner Apps

2026-09-28T14:41:27Z

Vsc: /* 3rdParty Terminal Device Provisioning */

Howto:Snom-DeskPhone-App - Snom - Partner App

2026-09-28T14:38:03Z

Vsc: Created page with "{{FIXME|reason=This article is currently under work. As long, as this disclaimer is displayed, information may change.}} gigaset-logo.png/ ==Product Name==   gigaset-deskphoneapp-logo.png/ [https://www.gigaset.com Gigaset] Gigaset-..."

{{FIXME|reason=This article is currently under work. As long, as this disclaimer is displayed, information may change.}}

[[Image:Gigaset-logo.png|200px|right|gigaset-logo.png/|gigaset-logo.png/]]

==Product Name==


[[Image:Gigaset-DeskPhoneApp-Logo.png|100px|gigaset-deskphoneapp-logo.png/|gigaset-deskphoneapp-logo.png/]]
[https://www.gigaset.com Gigaset] Gigaset-DeskPhone-App

==Certification Status==



{{Template:Compat_Status_referral_product_new|type=App}}

This App has been listed July 2025.

==Category==

[[Category:Partner Apps|{{PAGENAME}}]]
{{Category:3rdParty_Terminal_Devices}}
[[Category:3rdParty Terminal Devices|{{PAGENAME}}]]

==Vendor==



[[Image:Gigaset-LOGO.png|150px|gigaset-logo.png/|gigaset-logo.png/]]



With innovative communication solutions from Gigaset professional, your organisation can unlock its true potential and stay ahead of the competition.
Our cutting-edge telephony technology is delivered by a community of dedicated partners that can help you create a complete communications solution rather than a multitude of products.
With Gigaset professional, you gain access to an open platform designed for its user-friendliness, flexibility and outstanding performance, while offering seamless compatibility with leading on-premise telephony systems and cloud-based service providers.

[https://www.gigaset.com/pro/en_en/ Gigaset - Pro]

==Description==

{| class="wikitable"
| colspan="5" |Gigaset-DeskPhone App supports:
!
!
!
|-
| colspan="5" |DeskPhone P-Series
!
!
!
|-
!
!P710 IP PRO
!P810 IP PRO
!P810B IP PRO
!P820 IP PRO
!P825 IP PRO
!P850W IP PRO
!P855BW IP PRO
|-
!
![[File:P710.png|frameless|p710.png/|p710.png/]]
! colspan="2" |[[File:P810.png|frameless|p810.png/|p810.png/]]
! colspan="2" |[[File:P82x.png|frameless|360x360px|p82x.png/|p82x.png/]]
! colspan="2" |[[File:P85x.png|frameless|358x358px|p85x.png/|p85x.png/]]
|-
|
|
| colspan="2" |
| colspan="2" |
| colspan="2" |
|-
|Display
|2,8" TFT colour
| colspan="2" |3,36" TFT colour
| colspan="2" |5" TFT colour
| colspan="2" |5" TFT colour
|-
|Resolution (pixels)
|320 x 240
| colspan="2" |320 x 240
| colspan="2" |480 x 272
| colspan="2" |480 x 272
|-
|Tiltable display
| -
| colspan="2" | -
| -
|Yes
| -
|Yes
|-
|LAN switch
|2 ports, Gbit
| colspan="2" |2 ports, Gbit
| colspan="2" |2 ports, Gbit
| colspan="2" |2 ports, Gbit
|-
|PoE
|IEEE 802.3af, class 2
| colspan="2" |IEEE 802.3af, class 2
| colspan="2" |IEEE 802.3af, class 3
| colspan="2" |IEEE 802.3af, class 3
|-
|IP
|IPv4 & IPv6
| colspan="2" |IPv4 & IPv6
| colspan="2" |IPv4 & IPv6
| colspan="2" |IPv4 & IPv6
|-
|WLAN IEEE 802.11n/ac
| -
| colspan="2" | -
| colspan="2" | -
| colspan="2" |Yes
|-
|Bluetooth
| -
| -
|Yes
| colspan="2" | -
| -
|Yes
|-
|Headset connection via
|EHS/DHSG/RJ9 interface
| colspan="2" |EHS/DHSG/RJ9 interface
| colspan="2" |EHS/DHSG/RJ9 interface
| colspan="2" |EHS/DHSG/RJ9 interface
|-
|Function keys
|4 self labeling
| colspan="2" |4 (12) self labeling
| colspan="2" |8 (28) self labeling
| colspan="2" |10 (36) self labeling
|-
|G.711 A-law, µ-law

G.722 (wideband)

G.726, G.729AB, GSM 6.10 (FR)
|
| colspan="2" |Yes
| colspan="2" |Yes
| colspan="2" |Yes
|-
|Soft-keys
|4
| colspan="2" |4
| colspan="2" |4
| colspan="2" |4
|-
|SIP accounts
|6
| colspan="2" |12
| colspan="2" |12
| colspan="2" |12
|-
|USB
|No
| colspan="2" |1
| colspan="2" |1
|2
|1
|-
|P800 KEY PRO support
|No
| colspan="2" |via USB
| colspan="2" |via USB
| colspan="2" |via USB
|-
|GRAPE (Redirect and Provisioning)
|Yes
| colspan="2" |Yes
| colspan="2" |Yes
| colspan="2" |Yes
|}


The Gigaset DeskPhone App integrates the Gigaset P-Series IP PRO Phones into the innovaphone PBX environment.
After the initial setup, user and phonebook management can be done from the innovaphone myApps environment,
so that no further activities need to be performed on the Gigaset Phones.

==Functions==




* Add / Remove Gigaset DeskPhones
* Configure the Phonebook, keys and PBX Menue on Gigaset DeskPhones

With the Gigaset DeskPhone App it is possible to automatically add and remove DeskPhones.
In addition, the Phonebook, keys and PBX Menu configuration can be provisioned.

===Multi-PBX ready===




n.a.

===Cloud ready===



YES

== Provided APIs ==




* Websocket
* AdminApi
* TableUsers
* Services
* PbxApi

==Licensing==


No license is required for this app

==Prerequisites==


For BLF key signaling and pick-up a Group is needed where all phones are member of and logged in.

a PBX Object DTMF Features must be configured, with activated "Autocomplete '#'"

The app must not be installed and set up via myApps, that must be done via browser!

Because the connection from myApps to the app platform is only recognised as an http connection by SDK, even if https is used.

at least knowledge about installing an App on the AP Platform and adding the App Object via PBX Manager

''If the instance is operated in the innovaphone myApps Cloud, please request the following approvals on the Cloud RP via ticket at cloud@innovaphone.com, specifying the “instance number|domain name”:''

''musterschuster-p.innovaphone.com -> SIPS 5061 mit Check Certificate''

''musterschuster-a.innovaphone.com -> SIP 5060 (= Realm'00')''

''If you require additional realms for multiple customer master locations, e.g., for multiple Gigaset apps or instances, the following must also be requested:''

''musterschuster-a.realm01 -> SIP 50601''

''- bis max. -''

''musterschuster-a.realm50 -> SIP 50650''

==Versions==


===Compatible innovaphone firmware versions===

* innovaphone V14r2
* innovaphone V15r1 final

===Application versions used for interop testing===


* Gigaset DeskPhone-App - 142001 sr1

* innovaphone V15r1 final
* Gigaset Desktop IP PRO 10.1.198.16

==Configuration==


===Install the App===

===Gigaset - DeskPhone - App===

==== innovaphone settings ====
As an admin, create the environment settings in the Gigaset DeskPhone App.

For the innovaphone PBX, enter the domain, the IP address of the PBX or the FQDN, the SIP- or SIP-TLS Port, the MasterPBX-Name and the PBX password. You can also set Longname or E164 as an alternative, when DN is not set. If you want to show VoiceMail Messages into Phone Display enter the VoiceMail Number. Also define if reverse proxy and/or STUN Server should be activated or not and configure it accordingly. 

[[File:DeskPhone inno settings.png|frameless|600x600px|deskphone_inno_settings.png/|deskphone_inno_settings.png/]]

==== Gigaset settings ====
Enter the parameters for the phones to reach the App Platform. SIP realm and App Platform adress as an IP adress or FQDN. Also SIP port and protocol. if you need other SIP port then 5060/5061 via reverse Proxy, maybe if you use Gigaset DECT Provisioning App in parallel, enter it here. Port to Reverse Proxy still stays as 5060/5061.

'''Please note:''' If you want to use more then one Gigaset App instance or Gigaset DECT Provisioning in parallel, you need for each instance a SIP realm and a dedicated forwarding rule to the AP must be configured on the reverse proxy!

Username and password will be set for the phones web-ui. The phone connects via SIP with the App Platform, therefore the SIP-Password is needed. You can generate a random Password by using the button below.

If activating the additional admin mode, only basic settings will be shown in the web UI. After entering the administrator mode password, the complete admin web UI of the phone will be unlocked again.

[[File:DeskPhone gigaset settings.png|frameless|600x600px|deskphone_gigaset_settings.png/|deskphone_gigaset_settings.png/]]

==== number formatting ====
access code, prefixes, country and area code will be automatically read from the system.

this settings are not used by the phone at the moment.

[[File:DeskPhone number formatting.png|frameless|600x600px|deskphone_number_formatting.png/|deskphone_number_formatting.png/]]

==== key settings ====
This DeskPhone app reads the user's key configuration in two places. 1. Configured keys of the type: Dial and Partner

and 2. The user's favorites.

You can choose the order in which these two are displayed on the phone:

* Favorites first, then keys
* Keys first, then favorites
* Do not provision any changes

[[File:DeskPhone key settings1.png|frameless|543x543px|deskphone_key_settings1.png/|deskphone_key_settings1.png/]]

and you can choose where these keys should start on the phone:

* Ocupy from first page
* Occupy from second page
* Assign to key module
* Do not provision any changes

[[File:DeskPhone key settings2.png|frameless|547x547px|deskphone_key_settings2.png/|deskphone_key_settings2.png/]]

==== PBX menu settings ====
DekPhone App will automatically provide a PBX menu to the phones, like Gigaset Feature Control App does for Gigaset DECT. [[Howto:Gigaset-Feature-Control-App - Gigaset - Partner App]]

* Directory: will provide the local innovaphone LDAP contacts for dialing
* Diversion: see actual call diversion, set/change/activate/deactivate Diversion targets for Always, Busy and on No response.
* Group: show, join and leave Groups
* Presence: see actual Presence, change Presence to Online/Away/Busy/DND
* Working: see actual status of working and Start/Stop working

[[File:DeskPhone pbxmenu settings.png|frameless|600x600px|deskphone_pbxmenu_settings.png/|deskphone_pbxmenu_settings.png/]]

* advanced call forwarding: extend the Diversion menu by Diversion Busy and on No response.
* static groups: static Groups are shown on buttom of the list.
* function key: F4 as default, but you can choose F1-F3 also, or deactivate. this are they keys below the display of the phone.
* context sensitivity of the function key: e.g. on F4 normally info button is displayed when info messages are present, and into info menu the PBX menu button will shown until all mssages ar read, which this switch you can deactivate this behavior.
* menu name: this name will be displayed on the previously selected key.

==== phone book settings ====
Under Phonebook settings you can activate sync for a phonebook.
{| class="wikitable"
|+
![[File:DeskPhone phonebook settings1.png|frameless|555x555px|deskphone_phonebook_settings1.png/|deskphone_phonebook_settings1.png/]]
![[File:DeskPhone phonebook settings2.png|frameless|542x542px|deskphone_phonebook_settings2.png/|deskphone_phonebook_settings2.png/]]
|}
there are three different phone books available, you can configure only one at a time. the same for all three, first thing to choose is phone book key and set a name that will be displayed on the key.

# the standard LDAP directory of the innovaphone PBX (PBX0), which is also integrated in PBX menu. Please enter the IP address, port and previously created access data for the innovaphone LDAP.
# LDAP server where you manuelly enter all parameters.
# Contacts APP, enter the neccessary parameters:
#* phone book key : F3 (default)
#* Phonebook key name: name that will be displayed on the key
#* Host : innoapp.domain.de (address of the AP)
#* Port : 636
#* TLS : yes
#* LDAP search base : dc=entries
#* Username : [from PBX-Manager / AP Contacts / Change Configuration / User (LDAP)]
#* Password : [from PBX-Manager / AP Contacts / Change Configuration / Password (LDAP)]
#* Name filter : (|(cn=%)(sn=%))
#* Number filter : (metaSearchNumber=%)
#* all other entries as shown in below screenshot are preconfigured

[[File:DeskPhone phonebook settings Contacts.png|frameless|762x762px|deskphone_phonebook_settings_contacts.png/|deskphone_phonebook_settings_contacts.png/]] 

==== custom provisioning settings ====
You have the possibility to add provisioning parameters by your own in xml strings. You can find an overview of provisioning parameters here: 
'''[https://teamwork.gigaset.com/gigawiki/display/GPPPO/FAQ+-+Auto+provisioning%3A+Parameters Gigaset Desktop Phone Settings] '''

[[File:DeskPhone custom settings.png|frameless|545x545px|deskphone_custom_settings.png/|deskphone_custom_settings.png/]]

 
please have in mind, that you have to replace special signs with placeholders: & - &amp;

‘ - &apos;

< - &lt;

> - &gt;

” - &quot;

Ä - &#196;

Ö - &#214;

Ü - &#220;

ä - &#228;

ö - &#246;

ü - &#252;

ß - &#223;

 

==== Advanced settings ====

* "Reload Gigaset Devices" will be reload all Gigaset DeskPhones from Devices List. Keyword is the APP-Name, which is also inserted into the Devices. Wildcards are allowed.
* Execute Provisioning NOW will send a SIP-Notify to every connected Phone to force them to pull again the Provisioning File from Provisioning App.
* Firmware URLs: if you want to Update DeskPhone Firmware by the Provisioning App enter here a Web Url where the Phone can download it. e.g. path from Gigaset Wiki Firmware File.
* provisioning via HTTP instead of HTTPS: Gigaset DeskPhones does '''NOT support self signed certificates!''' if you have no official sigend certificates, force the App to provide a HTTP Link insted of HTTPS. The fact that the Copy Link button is not displayed is a restriction in the innovaphone SDK for unsecure connections.
* generate new secret: if needed you can generate a new secret. or if you have to reinstall the app, you can copy your previously used secret in.
* provisioning path: The app generates a provisioning path from its data. This path does not change as long as you do not regenerate a new secret. Copy this path and paste it on every new phone, you have to copy the Provisioning URL into the phone via Web-Ui. Setup --> Advanced --> Update --> Setting URL: copy it here and apply. Afterwards type on the phone: Settings --> Maintenance (5) --> Synchronize Settings (4) --> Ok

 

===Add Devices to User and start Provisioning===

Now create new end devices as usual via UserAdmin or the Profile app. Select "Gigaset + ''APP-Name''" in the manufacturer selection field and then enter the MAC adress of the phone.
You can find the MAC of the phone on the box, under the phone or by pressing settings --> Information (6) --> System Info (2) on the phone.

After you have saved the new phone, you have to copy the Provisioning URL into the phone via Web-Ui.

Setup --> Advanced --> Update --> Setting URL: copy it here and apply.

Afterwards type on the phone: Settings --> Maintenance (5) --> Synchronize Settings (4) --> Ok

[[File:DeskPhone Users Admin.png|frameless|883x883px|deskphone_users_admin.png/|deskphone_users_admin.png/]][[File:DeskPhone Devices1.png|frameless|900x900px|deskphone_devices1.png/|deskphone_devices1.png/]]

[[File:DeskPhone Web-Ui.png|frameless|790x790px|deskphone_web-ui.png/|deskphone_web-ui.png/]][[File:DeskPhone Devices2.png|frameless|900x900px|deskphone_devices2.png/|deskphone_devices2.png/]]

==Release Notes==
===Update Notice===

Even though this should be the standard procedure, we would still like to point this out. 
Before installing an update, we recommend backing up the PBX and the Gigaset application on the application platform so that a rollback of the configuration is possible.

=== 142004 sr1 ===

* change in socket connection handling

=== 142003 sr1 ===

* change for MOH not working
* added SIP-Server and APP-Platform via provisioning Parameter to trusted Hosts.
* call forwardings service codes optimisation
* PBX menu Directory Edit Mode button fixed

=== 142001 sr1 ===
- Startversion 

==Known Problems==

=== ReProvisioning or check-sync for CallForwarding or others are not working after time ===
Socket connection does not recognised when the device port has changed. fixed in 142004 sr1

=== URLs are shown as http instead of https ===
The app must not be installed and set up via myApps, that must be done via browser!

Because the connection from myApps to the app platform is only recognised as an http connection by SDK, even if https is used.

=== MOH not working ===
put this parameter in the custom phone settings part:

<user_hold_inactive idx="1" perm="">on</user_hold_inactive>

=== Same SIP Port/Protocol for PBX and APP-Plattform via Reverse Proxy ===
is not working, due to load optimizations of Reverse Proxy. choose 5061/TLS for PBX and 5060/TCP for App Plattform.

===Provisioning of devices via Users Admin not working===
Please note the following for environments that do not have Internet access. In this case, the assignment of devices via the Users Admin may be disrupted.
The Gigaset App works together with the provisioning service of the Devices App. The online provisioning server from innovpahone "config.innovaphone.com" is entered as the default in the Devices app. If the environment cannot reach the server, the process is aborted.
To avoid this, offline provisioning must be configured for the domain in the Devices app.
https://wiki.innovaphone.com/index.php?title=Reference13r1:Concept_Offline_Provisioning

=== Provisioning option not available in Users Admin when giving Profile app a custom name ===
When the name or long name of your profile app PBX object differs from the default names "Profile" (long name) and "profile" (name), you won't have the option to select "Gigaset - Gigaset Provisioning" as the manufacturer of the phone if you try to create new phone registrations via Users Admin. 

=== no Audio / disconnect after 30 - Gigaset phone is connected through a Reverse Proxy ===
Media Relay works only in a LAN. For working through a Reverse Proxy a view more settings are needed. See here:
https://wiki.innovaphone.com/index.php?title=Howto13r3:Step-by-Step_Media_Relay_connection_for_third_party_phone

== Related Articles ==
*[[Howto:MyApps Cloud - Using Gigaset-Provisioning-App in innovaphone cloud environments| Howto:Using Gigaset-Provisioning-App in innovaphone myApps cloud environments]]

==Contact==
Gigaset Technologies GmbH 
Frankenstraße 2 
46395 Bocholt

Tel: +49 2871 91-0 
E-Mail: de.pro@gigaset.com

'''Support''' 
+49 (89) 8780 6575 + PIN Code 
support@gigaset.com

'''Become a partner''' 
https://gigasetportal.force.com/Partner

'''App Feature Request''' 
Dennis Zimmermann 
Technical Sales Manager 
dennis.zimmermann@gigaset.com

Technical Compliances Phones

2026-09-28T09:53:58Z

Vsc: /* National and other Specific Compliances */

{{datasheet_header|innovaphone Technical Compliances|Deskphones}}
<div class="datasheets-mehrspaltig">
===European Compliances===
RoHS Regulation 2011/65/EU

Applies to IP101, IP102, IP111, IP112, IP222, IP222A, IP232, IP240, IP241:
* EN 55022/AC:2011-10
* EN 55024:2010-11

Applies to IP222A:
*EN55022:2010 + AC:2011
*EN55016-2-3:2010 + A1:2010
*EN61000-4-2:2009
*EN61000-4-3:2020-10
*EN61000-4-4:2012
*EN61000-4-6:2014

Applies to IP101, IP102, IP111, IP112, IP222, IP232:
* EN 60950-1:2006-04 + A1:2010-03 + A11:2009-03 + A12:2011-02

Applies to IP111, IP112:
* EN 60950-1 A2:2013

Applies to IP112A:
* EN 55032:2016
* EN 61000-3-2:2015
* EN 61000-3-3:2014
* EN 61000-4-2:2009
* EN 61000-4-3:2011
* EN 61000-4-4:2013
* EN 61000-4-5:2015
* EN 61000-4-6:2014
* EN 61000-4-8:2010
* EN 61000-4-11:200

Applies to IP160:
* EN 50102:1995 + A1:1999
* EN 55032:2015
* EN 60529:2014
* EN 61000-4-2:2009, EN 61000-4-3:2006 + ... + A2:2010, EN 61000-4-4:2012, EN 61000-4-5:2014, EN 61000-4-6:2014, EN 61000-6-2:2005, EN 61000-6-4:2007 + A1:2011
* EN 62368-1:2021, EN 62368-3:2020
* EN IEC 63000:2018
* ETSI ETS 300019-2-4:1994
* ETSI TBR 8 (10/98)

===National and other Specific Compliances===
Applies to IP10x, IP11x, IP2xx:
* ANSI C63.19 HAC

Applies to IP101, IP102:
* FCC Part 15 (US)
* ICES-003 (Canada)

Applies to IP111, IP112:
* FCC Part 15 (US)
* ICES-003 (Canada)

* Anatel (Brazil)

Applies to IP111A, IP112A:
* FCC Part 15 (US)
* ICES-003 (Canada)
* Anatel (Brazil)

Applies to IP111-maritime:
* DNV GL ([https://approvalfinder.dnv.com/#approval/TAA0000252 Certificate No: TAA0000252])

Applies to IP112-secure:
* BSI Technische Leitlinie 03305 (Germany)
* COTS TEMPEST ZONE1 (Germany)

Applies to IP150:
* EN 60945

Applies to IP17x:
* EN 55032:2015 + AC:2016 + A11:2020 + A1:2020
* EN 55035:2017 + AC:2016 + A11:2020
* IACS UR E10, Rev. 10, Aug. 2024
* DNV-CG-0339:2021
* IEC 60945:2002


{{Template:WEEE-Number2}}
</div>
{{Template:Datasheet_footer|EN}}
[[Category:Technical Compliances|{{PAGENAME}}]]

Technical Compliances Phones

2026-09-24T07:33:50Z

Vsc:

{{datasheet_header|innovaphone Technical Compliances|Deskphones}}
<div class="datasheets-mehrspaltig">
===European Compliances===
RoHS Regulation 2011/65/EU

Applies to IP101, IP102, IP111, IP112, IP222, IP222A, IP232, IP240, IP241:
* EN 55022/AC:2011-10
* EN 55024:2010-11

Applies to IP222A:
*EN55022:2010 + AC:2011
*EN55016-2-3:2010 + A1:2010
*EN61000-4-2:2009
*EN61000-4-3:2020-10
*EN61000-4-4:2012
*EN61000-4-6:2014

Applies to IP101, IP102, IP111, IP112, IP222, IP232:
* EN 60950-1:2006-04 + A1:2010-03 + A11:2009-03 + A12:2011-02

Applies to IP111, IP112:
* EN 60950-1 A2:2013

Applies to IP112A:
* EN 55032:2016
* EN 61000-3-2:2015
* EN 61000-3-3:2014
* EN 61000-4-2:2009
* EN 61000-4-3:2011
* EN 61000-4-4:2013
* EN 61000-4-5:2015
* EN 61000-4-6:2014
* EN 61000-4-8:2010
* EN 61000-4-11:200

Applies to IP160:
* EN 50102:1995 + A1:1999
* EN 55032:2015
* EN 60529:2014
* EN 61000-4-2:2009, EN 61000-4-3:2006 + ... + A2:2010, EN 61000-4-4:2012, EN 61000-4-5:2014, EN 61000-4-6:2014, EN 61000-6-2:2005, EN 61000-6-4:2007 + A1:2011
* EN 62368-1:2021, EN 62368-3:2020
* EN IEC 63000:2018
* ETSI ETS 300019-2-4:1994
* ETSI TBR 8 (10/98)

===National and other Specific Compliances===
Applies to IP101, IP102:
* FCC Part 15 (US)
* ICES-003 (Canada)

Applies to IP111, IP112:
* FCC Part 15 (US)
* ICES-003 (Canada)

* Anatel (Brazil)

Applies to IP111A, IP112A:
* FCC Part 15 (US)
* ICES-003 (Canada)
* Anatel (Brazil)

Applies to IP111-maritime:
* DNV GL ([https://approvalfinder.dnv.com/#approval/TAA0000252 Certificate No: TAA0000252])

Applies to IP112-secure:
* BSI Technische Leitlinie 03305 (Germany)
* COTS TEMPEST ZONE1 (Germany)

Applies to IP150:
* EN 60945

Applies to IP17x:
* EN 55032:2015 + AC:2016 + A11:2020 + A1:2020
* EN 55035:2017 + AC:2016 + A11:2020
* IACS UR E10, Rev. 10, Aug. 2024
* DNV-CG-0339:2021
* IEC 60945:2002


{{Template:WEEE-Number2}}
</div>
{{Template:Datasheet_footer|EN}}
[[Category:Technical Compliances|{{PAGENAME}}]]

Technical Compliances Phones

2026-09-24T07:15:44Z

Vsc:

{{datasheet_header|innovaphone Technical Compliances|Deskphones}}
<div class="datasheets-mehrspaltig">
===European Compliances===
RoHS Regulation 2011/65/EU

Applies to IP101, IP102, IP111, IP112, IP222, IP222A, IP232, IP240, IP241:
* EN 55022/AC:2011-10
* EN 55024:2010-11

Applies to IP222A:
*EN55022:2010 + AC:2011
*EN55016-2-3:2010 + A1:2010
*EN61000-4-2:2009
*EN61000-4-3:2020-10
*EN61000-4-4:2012
*EN61000-4-6:2014

Applies to IP101, IP102, IP111, IP112, IP222, IP232:
* EN 60950-1:2006-04 + A1:2010-03 + A11:2009-03 + A12:2011-02

Applies to IP111, IP112:
* EN 60950-1 A2:2013

Applies to IP112A:
* EN 55032:2016
* EN 61000-3-2:2015
* EN 61000-3-3:2014
* EN 61000-4-2:2009
* EN 61000-4-3:2011
* EN 61000-4-4:2013
* EN 61000-4-5:2015
* EN 61000-4-6:2014
* EN 61000-4-8:2010
* EN 61000-4-11:200

Applies to IP160:
* EN 50102:1995 + A1:1999
* EN 55032:2015
* EN 60529:2014
* EN 61000-4-2:2009, EN 61000-4-3:2006 + ... + A2:2010, EN 61000-4-4:2012, EN 61000-4-5:2014, EN 61000-4-6:2014, EN 61000-6-2:2005, EN 61000-6-4:2007 + A1:2011
* EN 62368-1:2021, EN 62368-3:2020
* EN IEC 63000:2018
* ETSI ETS 300019-2-4:1994
* ETSI TBR 8 (10/98)

===National and other Specific Compliances===
Applies to IP101, IP102:
* FCC Part 15 (US)
* ICES-003 (Canada)

Applies to IP111, IP112:
* FCC Part 15 (US)
* ICES-003 (Canada)

* Anatel (Brazil)

Applies to IP111A, IP112A:
* FCC Part 15 (US)
* ICES-003 (Canada)
* Anatel (Brazil)

Applies to IP111-maritime:
* DNV GL ([https://approvalfinder.dnv.com/#approval/TAA0000252 Certificate No: TAA0000252])

Applies to IP112-secure:
* BSI Technische Leitlinie 03305 (Germany)
* COTS TEMPEST ZONE1 (Germany)

Applies to IP150:
* EN 60945

Applies to IP17x:
* EN 55032:2015 + AC:2016 + A11:2020 + A1:2020
* EN 55035:2017 + AC:2016 + A11:2020
* IACS UR E10, Rev. 10, Aug. 2024
* DNVGL-CG-0339:2021
* IEC 60945:2002


{{Template:WEEE-Number2}}
</div>
{{Template:Datasheet_footer|EN}}
[[Category:Technical Compliances|{{PAGENAME}}]]

Reference15r1:Concept Chat

2026-09-21T12:57:54Z

Vsc: /* Tracing and logging */

[[Category:Concept|Chat]]

=== Features without license ===
'''Important:''' 
As soon, as the user has a chat license applied, chat is integrated into the [[Reference15r1:Concept_App_Connect#Chat|Connect App]]. Otherwise, the old Chat App is used. 

Features without license include the following:

;Volatile chat: Chat to other users, if these other users are online and respond to the incoming chat call
;Emojis: Some emojis can be selected to be included in the message. The emojis are sent as standard Unicode characters

== Technical Details ==

=== Client APIs ===

The client uses published PBX APIs to provide the service.

;PbxSignal: This is the API for signaling using Websocket/Json protocol. The Chat App uses the flag 'NO_MEDIA_CALL' when doing the register, so that no media call is sent to the Chat App. To mark a call as instant messaging call the facility 'im_setup' is used. Messages are transfered with the facility 'im_message'
;PbxMessages: This API provides access to an external Messages App Service. If a chat licenses is assigned to the user, the Chat App established a Session on the PbxMessages API.

=== API of Messages App Service ===

The PBX Objekt Messages establishes a AppWebsocket connection to the external Messages App Service. Documeneted messages on this connection are used for the additional services.

=== File Attachments ===

To attach a files to a chat message, the client uses a method 'CreateFileBuffer' of 'PbxMessages' to create a temporariy buffer for a file in the Messages App Service. The file is sent via HTTP POST to this buffer and a URL to the file is included in the im_message facility. The recepient of the message can read the file from this buffer, if online while the message was sent. After the message was sent, the file attachments are copied into permanent buffers on the sender and on the received side. To access these buffers other URLs then the URLs for the temporariy buffers are used.

=== Text Format ===

The texts are sent as plain HTML coded as UTF-8. Plain HTML means that no attributes for HTML elements may be used. This is enforced by the PBX to make sure no malicious content can be sent. The styling of the HTML is up to the receiver of the message.

== Tracing and logging ==

=== myApps log ===
The following trace flags can be activated at [[{{NAMESPACE}}:Maintenance/Diagnostics/Tracing | Maintenance/Diagnostics/Tracing]].

;PBX: communication between the PBX and the myApps client

;HTTP->Servlets: WebSocket communication between PBX and myAPPS client and also App Service. To enable this trace flag it's necessary to go to the debug.xml page.

Additionally, you can enable the following trace flags at the myApps client.
;App
: general information from the APP
;Browser Console
: information from the client/browser side.

=== Messages instance log ===
In case we use the additional features with license, there is an APP called "Messages" at APP Platform and we can enable the following trace flags for the instance "messages".
;App
: general information from the APP Messages
;Database
: information from APP database.
;App Websocket
: information from APP to PBX regarding websocket.
;Signalling
: information of signalling between App Messages to PBX

Howto:Snom-Hospitality-Provisioning-App - Snom - Partner App

2026-09-16T07:16:11Z

Vsc: Created page with "right ==Product Name== ; ; [https://service.snom.com/display/wiki/PhoneLink+for+innovaphone SNOM PhoneLink App] ==Certification Status== ; {{Template:Compat_Status_referral_product_new..."

Howto16r1:Configure SIP over Websocket

2026-09-16T06:13:01Z

Vsc: Created page with "== Applies To == This information applies to * innovaphone PBX * Firmware 15r1sr15 [1510764], 16r1sr3 [1610936] and later.  == More Information == === Problem Details === RFC 7118 / SIP over Websocket (also referred to as "SIP-over-WS" or "SIP-over-WSS") is a transport method for the SIP protocol in which SIP messages are transmitted over a WebSocket connection instead of UDP or..."

== Applies To ==
This information applies to
* innovaphone PBX
* Firmware 15r1sr15 [1510764], 16r1sr3 [1610936] and later.


== More Information ==
=== Problem Details ===
RFC 7118 / SIP over Websocket (also referred to as "SIP-over-WS" or "SIP-over-WSS") is a transport method for the SIP protocol in which SIP messages are transmitted over a WebSocket connection instead of UDP or TCP. This is particularly relevant for WebRTC-based SIP clients (e.g. browser softphones), since browsers do not allow direct UDP/TCP socket connections for security reasons, but do support WebSocket connections.

The advantages of SIP over Websocket are:
* The connection uses standard web ports (80/443) and therefore generally passes through firewalls and proxies without issues.
* An encrypted connection (WSS = WebSocket Secure, analogous to HTTPS) can be used.
* Browser-based SIP/WebRTC clients can communicate directly with an innovaphone PBX without requiring additional plugins.

On an innovaphone PBX, the URL used by a SIP client to register via WebSocket is:

wss://<PBX-DNS-name or PBX-IP>/SIP/websocket

Example:
wss://pbx.example.com/SIP/websocket

=== System Requirements ===
* innovaphone PBX with at least Firmware 15r1sr15 [1510764] or 16r1sr3 [1610936]
* A valid certificate installed on the PBX for the WSS connection (since wss:// requires a TLS-encrypted connection)
* A SIP/WebRTC-capable client that supports SIP over Websocket (e.g. a browser softphone or corresponding app)

=== Installation and Configuration ===
To use SIP over Websocket on the innovaphone PBX:
# Make sure a valid (ideally publicly trusted) TLS certificate is installed on the PBX.
# If using a reverse proxy, the wss-path to the PBX must also be enabled
# Configure the SIP client with the registrar/server address:
#: <code>wss://<PBX DNS name or IP>/SIP/websocket</code>
# Enter the username and password of the respective SIP object/user as usual for registration.

Reference14r2:General/Admin

2026-08-25T06:31:59Z

Vsc: /* Help URL */

Parameters for the Administration access of the device are configured here.

==Basic parameters==
===Device Name===
The name of the device. This name is displayed in the browser as a title. It is also added to the product id sent with outgoing registrations. This way it is displayed e.g. on the registrations page of the PBX.
===User/Password===
The administrator account. This account can be used for telnet access (if configured) and all password protected pages of the web user interface. By default all pages except Administration/General/Info are password protected. The web server of the device can be configured to protect all pages. The password has to be entered twice.

The password cannot be left empty. If an empty password is entered, the password won't be changed.
The length of the password is limited to 63 characters.

===Automatic Logout after (min)===
===Require Certificate===
If mutual TLS is used to login, the device does not usually check that the trusted client certificate is issued to the user who is trying to login.

For enhanced security the device can require that a trusted client certificate issued to the user is available to be able to login.

The following conditions must be met before enabling this feature:
* A trusted client certificate with the associated private key must be available in the web browser’s certificate store.
* The Subject Alternative Name in the certificate must correspond to the User ID entered at login.
* The trusted client certificate issued to the user or the CA certificate that signed client certificate must be added to the trust list in the device.
* Mutual TLS authentication must be enabled.
IMPORTANT: Make sure that the correct certificate is installed before requiring a user certificate.
If the correct certificate is not available, and mutual TLS authentication is enabled, it is not possible to access the device in any other way.
===Disable Native Authentication===
The use of http authentication can be disabled and the form-based login is used all the time when user authentication is required.
Native authentication is disabled by default.

== Additional Administrator Accounts ==

Additional user accounts. These user accounts can have viewer or full administrator privileges. The length of the password is limited to 15 characters.

== Limit sessions ==
Limit concurrent web-ui sessions in total or per user
== Help URL ==

The URL to access the online help. By default an URL of <nowiki>"http://wiki.innovaphone.com/index.php?Title=Reference<major firmware version number>:<page name>"</nowiki> is used. This links to online help pages in the Reference namespace of the innovaphone wiki.

For example on a V9 device configure following Help URL to link to the local wikitogo installation:

<code>http://192.168.0.100:8081/index.php?Title=Reference9:</code>

== Delegated Authentication ==
In v8 devices can delegate authentication of administrative users to an authentication server using Kerberos. To enable remote user authentication the device has to join the realm of an innovaphone Kerberos server. Delegated authentication can only be used with HTTPS.

=== Join realm ===

The server location of the realm has to be configured, first (see section "Authentication Servers").

Click "Join realm" and specify the username and password of an administrator in the target realm to add the device to the remote host database. This works only with innovaphone servers. If you want to authenticate users from a third-party server setup cross-realm authentication.

=== Leave realm ===

An administrator username and password from the realm is needed to deregister from the realm and remove the device from the remote host database. If the server does not exist any longer the registration can be deleted manually.

=== Default user realm ===

This is the default Kerberos realm that shall be used if users log-in without specifying a realm.

\user -> example.com\user
user@ -> user@example.com

If no default user realm is configured, the Kerberos realm of the box is used. So the parameter is only needed if users and devices are members of different realms.

=== Disable local authentication ===

If this option is selected only users from the Kerberos server are accepted. Logins using local administrator accounts will be rejected. Activating this feature together with [[Reference9:Phone/Protect|"Protect configuration at phone"]] option will disable you to make any changes on the phone.

== Authentication Servers ==

The addresses of Kerberos servers have to be configured locally on each host or client device.

If there is no server configured for a realm, the device will try to locate it using DNS. The Kerberos server is looked up in the following SRV record.

_kerberos._udp.REALM ''(e.g. _kerberos._udp.example.com)''

Normally this should work for Windows servers in the LAN.

The Kerberos admin service for joining and leaving realms is located using:

_kpasswd._udp.REALM ''(e.g. _kpasswd._udp.example.com)''

== Debugging ==
If you have trouble you may want to set <code>config add CMD0 /kerberos-trace</code> (and activate it) on the device you try to log-in to. On the kerberos server (if it is an innovaphone box), you can set the ''Kerberos Server'' check marks in ''Maintenance/Diagnostics/Logging'' and ''Maintenance/Diagnostics/Tracing''. Also keep in mind that kerberos-based authentication is '''only available with HTTPS'''.

Reference16r1:PBX/Objects

2026-08-18T07:10:37Z

Vsc: /* License */

This page is used for the administration of PBX objects. A list of already configured objects can be displayed filtered by various criteria. New objects can be created and existing objects can be changed or deleted.

== Display of existing Objects ==
By pressing the show link, existing objects are displayed. With the filter field (the input field left to the show link) the displayed objects are limited to those matching the filter. The filter is first applied to the 'Long Name' of the objects meaning a non case sensitive head match of the filter and the 'Long Name' is performed. If there are matching objects these are displayed.

If there are no matching objects the filter is used to match the Number of the objects including any node prefixes. This way objects of a given node with all sub-nodes can be displayed by entering the prefix of a node here.

Below the filter input field is a list of all PBXs in the system (at least the part of the system which is replicated to this device). By clicking on a PBX in the list only the objects which are assigned to this PBX are displayed and the groups configured on this PBX are displayed as well. By clicking on a group only the members of this group are displayed.

=== List of Objects ===

On the right side the list of objects is displayed. The most important configuration properties are displayed in this list to provide an overview. To view the full configuration of a given object it must be opened for editing by clicking the Long Name. The list can be sorted by clicking the table headers.

The Number of the objects in this list is not the number configured in the object but it is expanded with the prefixes of the nodes in which the object is configured.

Group memberships and Call Forwarding for an object are changed by clicking on the 'Groups' or 'CF*' link of the object. A '*' appended to a group displayed in this list means that the active flag of this group membership is set.
A '!' appended to a group displayed in this list means that group indications are configured for this group.

Fork number appended by a '*' indicates a mobility enabled user. In case the number is displayed in grey, the user consumes no mobility license on local PBX (e.g. because the user registers on other PBX).

The last column are the IP addresses of registered endpoints for a given object. If the physical location of the endpoint is not the same as the PBX, the physical location is indicated by @<physical-location> added to the IP address. A '*' appended to this field means that this is an password authenticated registration.
Registrations which are because of a standby situation, which means they are not at the PBX for which they are configured, are marked with a special colour (by default this is red).

=== New Objects ===

New objects are created by selecting the type of object in the drop down list and clicking the new link. If the list of displayed objects is limited to a PBX/Group (see above), the PBX property of the new object is preset accordingly and the group membership is added to the object.

== Object Types ==

There are different types of objects for different purposes available

;[[{{NAMESPACE}}:PBX/Objects/User|User]]: A normal User
;[[{{NAMESPACE}}:PBX/Objects/ap|AP]]: Used to enable pbx connection to Application Platform
;[[{{NAMESPACE}}:PBX/Objects/App|App]]: Create a reference to an innovaphone App that can be used in myApps
;[[{{NAMESPACE}}:PBX/Objects/Call Broadcast Conference|BC Conference]]: A Conference which automatically calls other users
;[[{{NAMESPACE}}:PBX/Objects/Boolean|Boolean]]: Used to enable Call Forwards an other things based on time/date or by calling to this object
;[[{{NAMESPACE}}:PBX/Objects/Call Broadcast|Call Broadcast]]: Forward a call to a group
;[[{{NAMESPACE}}:PBX/Objects/Conference|Conference]]: Used to create a conference
;[[{{NAMESPACE}}:PBX/Objects/Config Template|Config Template]]: Config which can be applied to other objects
;[[{{NAMESPACE}}:PBX/Objects/DECT System|DECT System]]: Defines a DECT system
;[[{{NAMESPACE}}:PBX/Objects/Directory Search|Directory Search]]: LDAP lookup based on number dialed
;[[{{NAMESPACE}}:PBX/Objects/DTMF Features|DTMF Features]]: Feature control for simple endpoints
;[[{{NAMESPACE}}:PBX/Objects/Executive|Executive]]: Executive in a executive/secretary configuration
;[[{{NAMESPACE}}:PBX/Objects/External UC|External UC]]: To forward presence subscriptions to external presence server
;[[{{NAMESPACE}}:PBX/Objects/Fax|Fax]]: Defines a fax service
;[[{{NAMESPACE}}:PBX/Objects/Gateway|Gateway]]: For registration of gateways
;[[{{NAMESPACE}}:PBX/Objects/ICP|ICP]]: Integration with ICP system
;[[{{NAMESPACE}}:PBX/Objects/MCast Announce|MCast Announce]]: Calls endpoints and forwards media as IP multicast
;[[{{NAMESPACE}}:PBX/Objects/Message Waiting|Message Waiting]]: Message Waiting for external Systems
;[[{{NAMESPACE}}:PBX/Objects/Messages|Messages]]: used to connect messaging service
;[[{{NAMESPACE}}:PBX/Objects/Mobility|Mobility]]: Mobile Integration
;[[{{NAMESPACE}}:PBX/Objects/Node|Node]]: Numbering Node
;[[{{NAMESPACE}}:PBX/Objects/Number Map|Number Map]]: Maps to other number
;[[{{NAMESPACE}}:PBX/Objects/PBX|PBX]]: To register slave PBX
;[[{{NAMESPACE}}:PBX/Objects/Push|Push]]: Defines a push service
;[[{{NAMESPACE}}:PBX/Objects/Directory Search|Quick Dial]]: Allows Quickdial based on external LDAP Directory
;[[{{NAMESPACE}}:PBX/Objects/Session Border|Session Border]]: Allows proxy registrations to other PBX
;[[{{NAMESPACE}}:PBX/Objects/Settings|Settings]]: control dynamic group memberships via myPBX client
;[[{{NAMESPACE}}:PBX/Objects/Trunk Line|Trunk Line]]: To register a trunk line
;[[{{NAMESPACE}}:PBX/Objects/Voicemail|Voicemail]]: Defines a voicemail service
;[[{{NAMESPACE}}:PBX/Objects/Waiting Queue|Waiting Queue]]: Define a waiting queue

== General Object Properties ==

Some configuration properties are specific to the type of object, some are common to all objects. Not each object type supports all general configuration properties.

;Description: Any text which can be used to describe the objects. Nothing is done with this text on the PBX.

;Hide from LDAP: When this check-mark is set, this object is available with a read-only LDAP access, which means it does not show up in the PBX phonebook on the phones.

;New Account: This checkmark can be set, adding a new User Object after deleting a User Object with the same Name, to that this is a new user and old information should not be reconnected to this user. Without this checkmark set, the name is used to connect the new User Object to the old information. This is mainly useful for information stored in Apps. Not every App does support this feature altready. It is supported by Connect and Chat, so when adding a user the setting of this checkmark means, that this is a new user and the old messages in Chat or Connect from a user with the same name are not visible for this user anymore.

;Long Name: This name is used to identify the object in the database and for display purposes. The long name must be unique throughout the system. For practical reasons, you should limit it to ''20 - extension length'' characters.

;Name
:The name of the object. This name is used for H.323 and SIP signalling (like a call number) and must be unique throughout the system.
:In order for the name to be handled correctly in all protocols, a few rules should be followed regarding the characters used.
:# The name must not start with a "." dot (See [[{{NAMESPACE}}:Concept Group Pickup across PBXs|Concept Group Pickup across PBXs]] for more details on using a dot.)
:# The character "@" must not be used (It is used as separator for E-Mail-Adresses)
:# The character "?" is a specially reserved character to append arguments, which can be used when a call is sent. (See [[{{NAMESPACE}}:PBX/Objects/Trunk_Line| Name as Number]] for more details on using a ?-sign.)
:# It is best to use only characters that are also used in e-mail addresses (before the @ sign). So "a-z0-9-_" in lower case letters.

:Note: Clients ''cannot'' use the ''Name'' and ''Number'' property as registration name without adding the ''name'' as hardware-id.
:Note: it is recommended to use the ''Name'' field for the e-mail address (everything prior the @) in combination with the ''Use as Domain'' flag at the ''System Name''.
:If the 'Name' is to be used as E-Mail address, the Check-mark on the ''E-Mail'' line besides the ''Name'' which is displayed there as well has to be set as well.

;Number
:The telephone number of the object. This is the number by which this object can be dialed within the same node. Which means it does not include any Node prefixes.
:Note: Clients ''cannot'' use the ''Name'' and ''Number'' property as registration name without adding the ''name'' as hardware-id.

;E-Mail: Additional E-Mail addresses for the user. Multiple addresses are separated by ';'. The 'Name' is used as E-Mail address as well together with the 'System Name' as domain. The E-Mail addresses are used to match users from other applications (e.g. Exchange, Fax Server) to PBX User Objects. The first E-Mail address is used as destination if E-Mails are to be sent to the User (e.g. received Fax). If the 'Name' shall be used as E-Mail destination, the check-mark besides the 'Name', which is duplicated to the E-Mail line should be set.

;Critical: If marked as critical the object can only be changed by administrators allowed to edit critical objects

;Password / Retype Password: If a registration password is allocated here, then it must be specified during registration, or otherwise the registration will fail. The length of the password is limited to 23 characters ASCII. Be aware when using Unicode characters like ü,ä,ö,ï,ë,é,ă,î,â,ș,ț,Ă,Î,Â,Ș,Ț,ă,î, due to the conversion from Unicode to ASCII the amount of available characters in your password will be decreased. You can use an online Unicode to ASCII converter to check if the password length is not exceeded.

;Node: The node that the object is assigned to. A Node hierarchy can be configured using Node Objects. Objects which are assigned to the same node can call each other with just the number. To call an object in a different node escapes and node prefixes have to be used. If no node is configured, the object is assigned to the node of the respective local PBX.

;PBX: The PBX that the object is assigned to. This PBX accepts registrations for the object. If no PBX is configured, the object is assigned to the respective local PBX.

;Reject ext. Calls: Calls from external sources to this object are rejected.

;Local: Marks an object as local. Local means that it can be called from endpoints physically located at the same PBX without prefixes even if the calling endpoint is in a different node. Where the endpoint is physical located is defined by the PBX the endpoint contacts first (it may be redirected to another PBX then for registration). If the object does not have a PBX configured the call is routed to the PBX where the calling endpoint is registered.
:''Note: Phones using this mechanism should use a Gatekeeper Identifier of <local-pbx>@<System Name> for registration. This way this mechanism works even if the registration happens without redirection. This can be the case if a secondary address is configured in case the local PBX is down. The registration will then be done without redirection an is not renewed when the local PBX comes up again.''

;Send Number: If an object does a call, the calling party number for this call will be replaced by the number given (if any). Used to hide an extension. If a prefix of '.' is configured, this number is interpreted as a number within the node of the object, if no prefix is configured the number is interpreted as a number within the root node.

;External: This is used together with the ''Name as Number'' Feature of a trunk object. If a ''Name as Number'' configuration is set, starting with '?' it is matched to this entry. If only '?' is configured it always matches. Any digit following the matching part is sent as CLI for calls out through the trunk object.

;Dial In: If this check-mark is set, the external CLI which is sent out on the trunk, can also be used to dial in from the trunk. In this case this CLI must be unique.

;URL: A URL configured here is send with any call from this object as source URL. Only H.323 support sending a URL. Some called endpoints may make use of the URL. The URL is also available within the CDRs generated by the gateway.

;Max Calls: Limits the concurrent calls to this object. Any additional call is rejected with "No Channel Available"

;Group Indications: The group for which group indications are sent to the registered endpoints. The object must be active member in this group. The other objects (for which group indications are sent) need not to be active. To monitor other endpoints on a phone with a Partner/Pickup function key group indications are needed for the endpoints. The maximal length of the Group Indication Name in V7 is set to 48 characters.

;Hide Connected Endpoint: This check-mark hides the name and number of the connected endpoint if an object with this check-mark set is called. This applies for example if a call forwarding was configured or the object was a broadcast group. In these cases the connected endpoint is different from the called.

== License ==

For User and Executive objects licenses which shall be used for this user can be configured. The licensed features can only be used if they are checked on this page.

;UCC: includes App(phone), App(softphone), Video, AppSharing, Voicemail, Mobility, Fax, App(chat), App(connect), App(innovaphone-pbx-conferencing), App(innovaphone-assistant), [[{{NAMESPACE}}:Concept_App_Service_Documents|Documents]], [[{{NAMESPACE}}:Concept_App_Service_Conference_Transcriptions|Conference Transcriptions]]
;UCC Upgrade from UC: upgrade license from UC to UCC. Requires availability of UC license.
;UCC Upgrade from Softphone: upgrade license from Softphone to UCC. Requires availability of Phone/Softphone or myPBX license.
When licences are distributed via a configuration template, 'UCC Upgrade from UC' or 'UCC Upgrade from Softphone' licences are used first, if available.
 If no upgrade is possible, a UCC licence is used. This means that all users who are to have UCC functionality can be configured for a UCC licence.
 It is not necessary to explicitly configure individual users for the upgrade.
 This mechanism is available from version 16r1sr4 onwards.
;UC: includes App(phone), App(softphone), Video, AppSharing, Voicemail, Mobility, Fax
;Voicemail:[[{{NAMESPACE}}:Concept_App_Service_Voicemail|Voicemail for this user]]
;Fax:[[{{NAMESPACE}}:Concept_App_Service_Fax|Personal Fax Application]], included in UC/UCC
;Mobility:[[{{NAMESPACE}}:Concept_App_RCC|Mobility device integration]], included in UC/UCC
;myPBX: myPBX client (outdated)
;Video: Video integrated within Phone and Softphone application, included in UC/UCC
;AppSharing: Application Sharing integrated within Phone and Softphone application, included in UC/UCC
;Reporting:[[{{NAMESPACE}}:Concept_App_Service_Reports|Reporting Application]], call lists do not require this license
;App(phone):[[{{NAMESPACE}}:Concept_App_PhoneApp|Phone Application]], included in UC/UCC
;App(softphone):[[{{NAMESPACE}}:Concept_App_SoftphoneApp|Softphone Application]], included in UC/UCC
;App(chat):[[{{NAMESPACE}}:Concept_Chat|Premium Chat application]] with message storage, included in UCC
;App(innovaphone-assistant):[[{{NAMESPACE}}:Concept_App_Service_myApps_Assistant|Assistant Application]], included in UCC
;App(innovaphone-working):[[{{NAMESPACE}}:Concept_App_Service_Working|Working Application]]
;App(innovaphone-switchboard):[[{{NAMESPACE}}:Concept_App_Service_Queues|Switchboard Application]]
;App(innovaphone-recorder):[[{{NAMESPACE}}:Concept_App_Service_Recordings|Voice Recording Application]]
;App(innovaphone-projects):[[{{NAMESPACE}}:Concept_App_Service_Projects|Projects Application]]
;App(innovaphone-pbx-conferencing):[[{{NAMESPACE}}:Concept_Conference|Conferencing Application]], included in UCC
;App(innovaphone-myphonekeys):[[{{NAMESPACE}}:Concept_App_myPhoneKeys|Desk Phone Control]]
;App(innovaphone-microsoft365):[[{{NAMESPACE}}:Concept_App_Service_Connector_for_Microsoft_365|Teams Connector]]
;App(innovaphone-kuando):[[{{NAMESPACE}}:Concept_App_Service_Connector_for_kuando%C2%AE|Kuando Connector]]
;App(innovaphone-connect):[[{{NAMESPACE}}:Concept_App_Connect|Connect Application]], included in UCC

== Devices ==
This section enables assignment and identification of multiple devices for the same user. Those devices may register and operate in parallel for this user.

=== Devices Input Fields ===
; Hardware Id: identifies the connected device to match the incoming registration. Can either be a MAC-address (for fixed phones) or a unique descriptor (for softphones/3rd-pty-terminals).
: Filled in automatically when phones are provisioned by UsersAdminApp or ProfileApp.
: If a hardware id identical to the object name is configured, the name or the number of the object can be used for registration. For registrations with name or number of the object, the settings configured at this device are used in this case.
; Name: can be used for a description of the device.
: On the SOAP/TAPI interface Name can be used to let the user select the device which shall be controlled.
: If no device is configured the Name and Hardware Id are used for default devices to ensure configuration compatibility.
: To allow an endpoint to register with the objects Name or Number, a device must be configured with a hardware id that is equal to the object Name. (E.g. Registrations from DECT Base Stations)
: A registration by number does not succeed if the length of the number does not match, other when dialing an object in which case additional dialed digits are ignored.
: If a registration by number does not match any object number, the number is converted to a name and a device hardware id is searched with this name.
; App: this field allows to configure a V13-App used to control this device. E.g. "phone" or "softphone" in lower letters.
: If a hardware ID is already present, this field is not set automatically during install and thus must be manually set.
: Name field should also be filled with an unambiguous description for use in myApps. Example :
: <table>
<tr>
<th>Hardware Id</th>
<th>Name</th>
<th>App</th>
</tr>
<tr>
<td>009033000000</td>
<td>myDeskphoneName</td>
<td>phone</td>
</tr>
<tr>
<td>exampleSoft</td>
<td>mySoftphoneName</td>
<td>softphone</td>
</tr>
:</table>

=== Devices Config Flags ===

;PBX Pwd: Registration with the PBX master password only

;No IP Filter: Don't apply IP Filters for registrations

;TLS only: Allow Registration with H.323/TLS only. If this check-mark is set a matching certificate, which is trusted by the PBX must be provided.

;No Mobility: If a registration on this device is active don't call a mobility number

;Config VOIP: Add additional config for VoIP. E.g. configure a WebRTC endpoint. Apply has to be pressed once and Name Field must be set to allow enable the additional input page with the "defined" name.
: If this checkmark is set and a '''Name''' is configured for the Device a new tab-sheet with the configured name is available to allow more VoIP Parameters to be configured.

;Reverse Proxy: Allow the device to register through a reverse proxy. The registration through a reverse proxy is identified by the IP addresses configured for reverse proxies

;Single Reg.: Allow a single registration to this device only

;Media Relay: Force Media Relay on the PBX for this device only.
: When this is enabled and the registration of the device is coming in via a reverse proxy server server-reflexive address (SRFLX) obtained via STUN is provided as default media address.
: This feature is used so that third party SIP phones not supporting ICE/DTLS can be used together with the innovaphone PBX as on-site phones as well as phones in home offices or phones in a cloud scenario.

;No SRTP: Do not offer SRTP in SIP/SDP when Media Relay is set at the Hardware ID

=== Security issues ===

There are security build in mechanisms :

* If the '''PBX Pwd''' (in older V9 builds AdminPwd) check-mark is set, registration to this device is only possible with the PBX password, which is configured in PBX/Config/Security.

* The check-mark '''No IP Filter''' allows the registration to the device even if the IP Filter does not match. This way general registration can be restricted using the IP Filters and some selected devices can be opened for registration from the public internet. A registration without password is not allowed in this case. (Available from v9 hf15)

* If this object will have no registration, leave the device field empty (for security reasons). Nobody can abuse and register at that object.

* If a registration request comes with the wrong password the object deny´s '''all''' registration requests (with the reason REGISTER-REJ : Reason=PBX missing Authentication) for 20 seconds. After that time it is possible to register (with the right password).

== Objects with empty node or PBX ==
If an object has no '''PBX''' configured, it will be replicated (if replication is turned on) to all slaves. Furthermore, any PBX will satisfy incoming registration requests. Calls to such objects that are built-in to the PBX and thus do not require a registration to work (e.g. Waiting Queue) will be processed by each PBX the call is presented to.

If an object has no '''Node''' configured, it will be considered to live in the node of each PBX the object is known to. So if an object has neither '''Node''' nor '''PBX''' configured, it will be present in all nodes that have a PBX and calls to such objects will be processed locally for objects that are built-in to the PBX.

Reference16r1:PBX/Objects

2026-08-17T14:05:19Z

Vsc: /* License */

This page is used for the administration of PBX objects. A list of already configured objects can be displayed filtered by various criteria. New objects can be created and existing objects can be changed or deleted.

== Display of existing Objects ==
By pressing the show link, existing objects are displayed. With the filter field (the input field left to the show link) the displayed objects are limited to those matching the filter. The filter is first applied to the 'Long Name' of the objects meaning a non case sensitive head match of the filter and the 'Long Name' is performed. If there are matching objects these are displayed.

If there are no matching objects the filter is used to match the Number of the objects including any node prefixes. This way objects of a given node with all sub-nodes can be displayed by entering the prefix of a node here.

Below the filter input field is a list of all PBXs in the system (at least the part of the system which is replicated to this device). By clicking on a PBX in the list only the objects which are assigned to this PBX are displayed and the groups configured on this PBX are displayed as well. By clicking on a group only the members of this group are displayed.

=== List of Objects ===

On the right side the list of objects is displayed. The most important configuration properties are displayed in this list to provide an overview. To view the full configuration of a given object it must be opened for editing by clicking the Long Name. The list can be sorted by clicking the table headers.

The Number of the objects in this list is not the number configured in the object but it is expanded with the prefixes of the nodes in which the object is configured.

Group memberships and Call Forwarding for an object are changed by clicking on the 'Groups' or 'CF*' link of the object. A '*' appended to a group displayed in this list means that the active flag of this group membership is set.
A '!' appended to a group displayed in this list means that group indications are configured for this group.

Fork number appended by a '*' indicates a mobility enabled user. In case the number is displayed in grey, the user consumes no mobility license on local PBX (e.g. because the user registers on other PBX).

The last column are the IP addresses of registered endpoints for a given object. If the physical location of the endpoint is not the same as the PBX, the physical location is indicated by @<physical-location> added to the IP address. A '*' appended to this field means that this is an password authenticated registration.
Registrations which are because of a standby situation, which means they are not at the PBX for which they are configured, are marked with a special colour (by default this is red).

=== New Objects ===

New objects are created by selecting the type of object in the drop down list and clicking the new link. If the list of displayed objects is limited to a PBX/Group (see above), the PBX property of the new object is preset accordingly and the group membership is added to the object.

== Object Types ==

There are different types of objects for different purposes available

;[[{{NAMESPACE}}:PBX/Objects/User|User]]: A normal User
;[[{{NAMESPACE}}:PBX/Objects/ap|AP]]: Used to enable pbx connection to Application Platform
;[[{{NAMESPACE}}:PBX/Objects/App|App]]: Create a reference to an innovaphone App that can be used in myApps
;[[{{NAMESPACE}}:PBX/Objects/Call Broadcast Conference|BC Conference]]: A Conference which automatically calls other users
;[[{{NAMESPACE}}:PBX/Objects/Boolean|Boolean]]: Used to enable Call Forwards an other things based on time/date or by calling to this object
;[[{{NAMESPACE}}:PBX/Objects/Call Broadcast|Call Broadcast]]: Forward a call to a group
;[[{{NAMESPACE}}:PBX/Objects/Conference|Conference]]: Used to create a conference
;[[{{NAMESPACE}}:PBX/Objects/Config Template|Config Template]]: Config which can be applied to other objects
;[[{{NAMESPACE}}:PBX/Objects/DECT System|DECT System]]: Defines a DECT system
;[[{{NAMESPACE}}:PBX/Objects/Directory Search|Directory Search]]: LDAP lookup based on number dialed
;[[{{NAMESPACE}}:PBX/Objects/DTMF Features|DTMF Features]]: Feature control for simple endpoints
;[[{{NAMESPACE}}:PBX/Objects/Executive|Executive]]: Executive in a executive/secretary configuration
;[[{{NAMESPACE}}:PBX/Objects/External UC|External UC]]: To forward presence subscriptions to external presence server
;[[{{NAMESPACE}}:PBX/Objects/Fax|Fax]]: Defines a fax service
;[[{{NAMESPACE}}:PBX/Objects/Gateway|Gateway]]: For registration of gateways
;[[{{NAMESPACE}}:PBX/Objects/ICP|ICP]]: Integration with ICP system
;[[{{NAMESPACE}}:PBX/Objects/MCast Announce|MCast Announce]]: Calls endpoints and forwards media as IP multicast
;[[{{NAMESPACE}}:PBX/Objects/Message Waiting|Message Waiting]]: Message Waiting for external Systems
;[[{{NAMESPACE}}:PBX/Objects/Messages|Messages]]: used to connect messaging service
;[[{{NAMESPACE}}:PBX/Objects/Mobility|Mobility]]: Mobile Integration
;[[{{NAMESPACE}}:PBX/Objects/Node|Node]]: Numbering Node
;[[{{NAMESPACE}}:PBX/Objects/Number Map|Number Map]]: Maps to other number
;[[{{NAMESPACE}}:PBX/Objects/PBX|PBX]]: To register slave PBX
;[[{{NAMESPACE}}:PBX/Objects/Push|Push]]: Defines a push service
;[[{{NAMESPACE}}:PBX/Objects/Directory Search|Quick Dial]]: Allows Quickdial based on external LDAP Directory
;[[{{NAMESPACE}}:PBX/Objects/Session Border|Session Border]]: Allows proxy registrations to other PBX
;[[{{NAMESPACE}}:PBX/Objects/Settings|Settings]]: control dynamic group memberships via myPBX client
;[[{{NAMESPACE}}:PBX/Objects/Trunk Line|Trunk Line]]: To register a trunk line
;[[{{NAMESPACE}}:PBX/Objects/Voicemail|Voicemail]]: Defines a voicemail service
;[[{{NAMESPACE}}:PBX/Objects/Waiting Queue|Waiting Queue]]: Define a waiting queue

== General Object Properties ==

Some configuration properties are specific to the type of object, some are common to all objects. Not each object type supports all general configuration properties.

;Description: Any text which can be used to describe the objects. Nothing is done with this text on the PBX.

;Hide from LDAP: When this check-mark is set, this object is available with a read-only LDAP access, which means it does not show up in the PBX phonebook on the phones.

;New Account: This checkmark can be set, adding a new User Object after deleting a User Object with the same Name, to that this is a new user and old information should not be reconnected to this user. Without this checkmark set, the name is used to connect the new User Object to the old information. This is mainly useful for information stored in Apps. Not every App does support this feature altready. It is supported by Connect and Chat, so when adding a user the setting of this checkmark means, that this is a new user and the old messages in Chat or Connect from a user with the same name are not visible for this user anymore.

;Long Name: This name is used to identify the object in the database and for display purposes. The long name must be unique throughout the system. For practical reasons, you should limit it to ''20 - extension length'' characters.

;Name
:The name of the object. This name is used for H.323 and SIP signalling (like a call number) and must be unique throughout the system.
:In order for the name to be handled correctly in all protocols, a few rules should be followed regarding the characters used.
:# The name must not start with a "." dot (See [[{{NAMESPACE}}:Concept Group Pickup across PBXs|Concept Group Pickup across PBXs]] for more details on using a dot.)
:# The character "@" must not be used (It is used as separator for E-Mail-Adresses)
:# The character "?" is a specially reserved character to append arguments, which can be used when a call is sent. (See [[{{NAMESPACE}}:PBX/Objects/Trunk_Line| Name as Number]] for more details on using a ?-sign.)
:# It is best to use only characters that are also used in e-mail addresses (before the @ sign). So "a-z0-9-_" in lower case letters.

:Note: Clients ''cannot'' use the ''Name'' and ''Number'' property as registration name without adding the ''name'' as hardware-id.
:Note: it is recommended to use the ''Name'' field for the e-mail address (everything prior the @) in combination with the ''Use as Domain'' flag at the ''System Name''.
:If the 'Name' is to be used as E-Mail address, the Check-mark on the ''E-Mail'' line besides the ''Name'' which is displayed there as well has to be set as well.

;Number
:The telephone number of the object. This is the number by which this object can be dialed within the same node. Which means it does not include any Node prefixes.
:Note: Clients ''cannot'' use the ''Name'' and ''Number'' property as registration name without adding the ''name'' as hardware-id.

;E-Mail: Additional E-Mail addresses for the user. Multiple addresses are separated by ';'. The 'Name' is used as E-Mail address as well together with the 'System Name' as domain. The E-Mail addresses are used to match users from other applications (e.g. Exchange, Fax Server) to PBX User Objects. The first E-Mail address is used as destination if E-Mails are to be sent to the User (e.g. received Fax). If the 'Name' shall be used as E-Mail destination, the check-mark besides the 'Name', which is duplicated to the E-Mail line should be set.

;Critical: If marked as critical the object can only be changed by administrators allowed to edit critical objects

;Password / Retype Password: If a registration password is allocated here, then it must be specified during registration, or otherwise the registration will fail. The length of the password is limited to 23 characters ASCII. Be aware when using Unicode characters like ü,ä,ö,ï,ë,é,ă,î,â,ș,ț,Ă,Î,Â,Ș,Ț,ă,î, due to the conversion from Unicode to ASCII the amount of available characters in your password will be decreased. You can use an online Unicode to ASCII converter to check if the password length is not exceeded.

;Node: The node that the object is assigned to. A Node hierarchy can be configured using Node Objects. Objects which are assigned to the same node can call each other with just the number. To call an object in a different node escapes and node prefixes have to be used. If no node is configured, the object is assigned to the node of the respective local PBX.

;PBX: The PBX that the object is assigned to. This PBX accepts registrations for the object. If no PBX is configured, the object is assigned to the respective local PBX.

;Reject ext. Calls: Calls from external sources to this object are rejected.

;Local: Marks an object as local. Local means that it can be called from endpoints physically located at the same PBX without prefixes even if the calling endpoint is in a different node. Where the endpoint is physical located is defined by the PBX the endpoint contacts first (it may be redirected to another PBX then for registration). If the object does not have a PBX configured the call is routed to the PBX where the calling endpoint is registered.
:''Note: Phones using this mechanism should use a Gatekeeper Identifier of <local-pbx>@<System Name> for registration. This way this mechanism works even if the registration happens without redirection. This can be the case if a secondary address is configured in case the local PBX is down. The registration will then be done without redirection an is not renewed when the local PBX comes up again.''

;Send Number: If an object does a call, the calling party number for this call will be replaced by the number given (if any). Used to hide an extension. If a prefix of '.' is configured, this number is interpreted as a number within the node of the object, if no prefix is configured the number is interpreted as a number within the root node.

;External: This is used together with the ''Name as Number'' Feature of a trunk object. If a ''Name as Number'' configuration is set, starting with '?' it is matched to this entry. If only '?' is configured it always matches. Any digit following the matching part is sent as CLI for calls out through the trunk object.

;Dial In: If this check-mark is set, the external CLI which is sent out on the trunk, can also be used to dial in from the trunk. In this case this CLI must be unique.

;URL: A URL configured here is send with any call from this object as source URL. Only H.323 support sending a URL. Some called endpoints may make use of the URL. The URL is also available within the CDRs generated by the gateway.

;Max Calls: Limits the concurrent calls to this object. Any additional call is rejected with "No Channel Available"

;Group Indications: The group for which group indications are sent to the registered endpoints. The object must be active member in this group. The other objects (for which group indications are sent) need not to be active. To monitor other endpoints on a phone with a Partner/Pickup function key group indications are needed for the endpoints. The maximal length of the Group Indication Name in V7 is set to 48 characters.

;Hide Connected Endpoint: This check-mark hides the name and number of the connected endpoint if an object with this check-mark set is called. This applies for example if a call forwarding was configured or the object was a broadcast group. In these cases the connected endpoint is different from the called.

== License ==

For User and Executive objects licenses which shall be used for this user can be configured. The licensed features can only be used if they are checked on this page.

;UCC: includes App(phone), App(softphone), Video, AppSharing, Voicemail, Mobility, Fax, App(chat), App(connect), App(innovaphone-pbx-conferencing), App(innovaphone-assistant), [[{{NAMESPACE}}:Concept_App_Service_Documents|Documents]], [[{{NAMESPACE}}:Concept_App_Service_Conference_Transcriptions|Conference Transcriptions]]
;UCC Upgrade from UC: upgrade license from UC to UCC
:This option is no more necessary since mid August'26, as my.innovaphone provides a UCC-license for each pair of "UC" and "UCC Upgrade from UC".
;UCC Upgrade from Softphone: upgrade license from Softphone to UCC
;UC: includes App(phone), App(softphone), Video, AppSharing, Voicemail, Mobility, Fax
;Voicemail:[[{{NAMESPACE}}:Concept_App_Service_Voicemail|Voicemail for this user]]
;Fax:[[{{NAMESPACE}}:Concept_App_Service_Fax|Personal Fax Application]], included in UC/UCC
;Mobility:[[{{NAMESPACE}}:Concept_App_RCC|Mobility device integration]], included in UC/UCC
;myPBX: myPBX client (outdated)
;Video: Video integrated within Phone and Softphone application, included in UC/UCC
;AppSharing: Application Sharing integrated within Phone and Softphone application, included in UC/UCC
;Reporting:[[{{NAMESPACE}}:Concept_App_Service_Reports|Reporting Application]], call lists do not require this license
;App(phone):[[{{NAMESPACE}}:Concept_App_PhoneApp|Phone Application]], included in UC/UCC
;App(softphone):[[{{NAMESPACE}}:Concept_App_SoftphoneApp|Softphone Application]], included in UC/UCC
;App(chat):[[{{NAMESPACE}}:Concept_Chat|Premium Chat application]] with message storage, included in UCC
;App(innovaphone-assistant):[[{{NAMESPACE}}:Concept_App_Service_myApps_Assistant|Assistant Application]], included in UCC
;App(innovaphone-working):[[{{NAMESPACE}}:Concept_App_Service_Working|Working Application]]
;App(innovaphone-switchboard):[[{{NAMESPACE}}:Concept_App_Service_Queues|Switchboard Application]]
;App(innovaphone-recorder):[[{{NAMESPACE}}:Concept_App_Service_Recordings|Voice Recording Application]]
;App(innovaphone-projects):[[{{NAMESPACE}}:Concept_App_Service_Projects|Projects Application]]
;App(innovaphone-pbx-conferencing):[[{{NAMESPACE}}:Concept_Conference|Conferencing Application]], included in UCC
;App(innovaphone-myphonekeys):[[{{NAMESPACE}}:Concept_App_myPhoneKeys|Desk Phone Control]]
;App(innovaphone-microsoft365):[[{{NAMESPACE}}:Concept_App_Service_Connector_for_Microsoft_365|Teams Connector]]
;App(innovaphone-kuando):[[{{NAMESPACE}}:Concept_App_Service_Connector_for_kuando%C2%AE|Kuando Connector]]
;App(innovaphone-connect):[[{{NAMESPACE}}:Concept_App_Connect|Connect Application]], included in UCC

== Devices ==
This section enables assignment and identification of multiple devices for the same user. Those devices may register and operate in parallel for this user.

=== Devices Input Fields ===
; Hardware Id: identifies the connected device to match the incoming registration. Can either be a MAC-address (for fixed phones) or a unique descriptor (for softphones/3rd-pty-terminals).
: Filled in automatically when phones are provisioned by UsersAdminApp or ProfileApp.
: If a hardware id identical to the object name is configured, the name or the number of the object can be used for registration. For registrations with name or number of the object, the settings configured at this device are used in this case.
; Name: can be used for a description of the device.
: On the SOAP/TAPI interface Name can be used to let the user select the device which shall be controlled.
: If no device is configured the Name and Hardware Id are used for default devices to ensure configuration compatibility.
: To allow an endpoint to register with the objects Name or Number, a device must be configured with a hardware id that is equal to the object Name. (E.g. Registrations from DECT Base Stations)
: A registration by number does not succeed if the length of the number does not match, other when dialing an object in which case additional dialed digits are ignored.
: If a registration by number does not match any object number, the number is converted to a name and a device hardware id is searched with this name.
; App: this field allows to configure a V13-App used to control this device. E.g. "phone" or "softphone" in lower letters.
: If a hardware ID is already present, this field is not set automatically during install and thus must be manually set.
: Name field should also be filled with an unambiguous description for use in myApps. Example :
: <table>
<tr>
<th>Hardware Id</th>
<th>Name</th>
<th>App</th>
</tr>
<tr>
<td>009033000000</td>
<td>myDeskphoneName</td>
<td>phone</td>
</tr>
<tr>
<td>exampleSoft</td>
<td>mySoftphoneName</td>
<td>softphone</td>
</tr>
:</table>

=== Devices Config Flags ===

;PBX Pwd: Registration with the PBX master password only

;No IP Filter: Don't apply IP Filters for registrations

;TLS only: Allow Registration with H.323/TLS only. If this check-mark is set a matching certificate, which is trusted by the PBX must be provided.

;No Mobility: If a registration on this device is active don't call a mobility number

;Config VOIP: Add additional config for VoIP. E.g. configure a WebRTC endpoint. Apply has to be pressed once and Name Field must be set to allow enable the additional input page with the "defined" name.
: If this checkmark is set and a '''Name''' is configured for the Device a new tab-sheet with the configured name is available to allow more VoIP Parameters to be configured.

;Reverse Proxy: Allow the device to register through a reverse proxy. The registration through a reverse proxy is identified by the IP addresses configured for reverse proxies

;Single Reg.: Allow a single registration to this device only

;Media Relay: Force Media Relay on the PBX for this device only.
: When this is enabled and the registration of the device is coming in via a reverse proxy server server-reflexive address (SRFLX) obtained via STUN is provided as default media address.
: This feature is used so that third party SIP phones not supporting ICE/DTLS can be used together with the innovaphone PBX as on-site phones as well as phones in home offices or phones in a cloud scenario.

;No SRTP: Do not offer SRTP in SIP/SDP when Media Relay is set at the Hardware ID

=== Security issues ===

There are security build in mechanisms :

* If the '''PBX Pwd''' (in older V9 builds AdminPwd) check-mark is set, registration to this device is only possible with the PBX password, which is configured in PBX/Config/Security.

* The check-mark '''No IP Filter''' allows the registration to the device even if the IP Filter does not match. This way general registration can be restricted using the IP Filters and some selected devices can be opened for registration from the public internet. A registration without password is not allowed in this case. (Available from v9 hf15)

* If this object will have no registration, leave the device field empty (for security reasons). Nobody can abuse and register at that object.

* If a registration request comes with the wrong password the object deny´s '''all''' registration requests (with the reason REGISTER-REJ : Reason=PBX missing Authentication) for 20 seconds. After that time it is possible to register (with the right password).

== Objects with empty node or PBX ==
If an object has no '''PBX''' configured, it will be replicated (if replication is turned on) to all slaves. Furthermore, any PBX will satisfy incoming registration requests. Calls to such objects that are built-in to the PBX and thus do not require a registration to work (e.g. Waiting Queue) will be processed by each PBX the call is presented to.

If an object has no '''Node''' configured, it will be considered to live in the node of each PBX the object is known to. So if an object has neither '''Node''' nor '''PBX''' configured, it will be present in all nodes that have a PBX and calls to such objects will be processed locally for objects that are built-in to the PBX.

Reference16r1:PBX/Config/General

2026-08-13T09:57:08Z

Vsc: /* Common */

== Configuration ==

=== Common ===

;PBX Mode: The PBX operating mode
:* '''Off''' - The PBX is disabled. After enabling the PBX a browser refresh is needed to activate additional PBX webpages.
:* '''Master''' - The PBX on this device acts as Master. Within a multisite installation exactly one PBX must be configured as Master.
:* '''Slave''' - The PBX on this device acts as Slave. Within a multisite installation several PBXes can be configured as Slave.
:* '''Standby''' - The PBX on this device acts as Standby for the Master. As long as the master is available, this PBX is not active, but just monitors the Master. If the Master is not available this PBX is active.
:* '''Standby-Slave''' - The PBX on this device acts as Standby for a Slave. As long as the slave is available, this PBX is not active, but just monitors the slave. If the slave is not available this PBX is active.

;System Name: The system Name. On all PBX within a multisite installation the same System Name must be configured. For H.323 endpoints this name is the gatekeeper identifier, for SIP endpoints it is the server name.

;Use as Domain: Uses the ''System Name'' as domain name, together with the name field in the user object the PBX constructs the email address (used for sending emails out ox myPBX). This mechanism is also used for Federation, to federate with other domains.

;PBX Name: The name of the PBX on this device. With this name a PBX is associated to a node. The field 'Name' (not Long Name) of a PBX Node object relates to this name.

;DNS: DNS Name of the PBX. If configured this will be used for myPBX redirects if a client tries to register at a PBX on which the user is not configured.

;Unknown Registrations: If this checkmark is set, the PBX accepts 'unknown' registrations. This means registrations with no matching object configured. If from an endpoint registered in this way a number of an object is dialed, which has no registration active and no 'HW-ID' configured the name used for the registration is configured as 'HW-ID' of this object. This is an easy way to deploy large numbers of phones.

:'''With PBX Pwd only:''' If checked only registrations with a PBX authentication or a verified certificate in case of H.323/TLS are accepted. In this case either "PBX Pwd" or "TLS only" is set in a device generated.

;Reverse Proxy Addresses: Up to 8 IP-Addresses (Mixed IPv4 and IPv6 allowed but no DNS names) can be entered in this field, separated by comma. Registrations from one of these addresses are assumed to be routed through a Reverse Proxy. To the address '/<certificate name>' can be added to also check the TLS certificate of the Reverse Proxy. If the reverse proxy certificate is to be verified, the certificate or the issuer of the reverse proxy certificate must be trusted in the PBX. (If you use a SAN certificate you have to enter the first SAN-Name)
:If empty addresses are used, unauthenticated registrations from unknown or internal addresses are not allowed, but any registration must be authenticated, with a password or the certificate from the reverse proxy.
; Assume TLS: If the ''Assume TLS'' checkmark is set, it is assumed, that the reverse Proxy did a successful check of the TLS certificate against the registration name.

;Media relay endpoint/Firewall public IP: For media relay endpoints (e.g. third party SIP phones) the public address of the firewall of the PBX network can be configured. This address is signaled in the SDP to received RTP from the phone. The firewall should have configured a port forwarding to the PBX or the TURN, for the RTP range of the PBX or TURN.

;Media relay endpoint/TURN: If this checkmark is set, the PBX allocates TURN endpoints for calls to or from media relay endpoints, which registerd thru the reverse proxy (e.g. third party SIP phones)

;IP address for App Platform
: The ip address of an App Platform can be configured here, with a DNS name used for it. If myApps uses a host to access the PBX different from the configured DNS name of the PBX, the hostname in any App url, which matches the configured AP DNS, is replaced by the AP IP. This way it is possible to configure a PBX with DNS names and access it with myApps when the DNS is not yet set up. If the checkmark ''Operation without DNS'' is set as well any matching DNS name is replaced also when an App service requests the URL of another App service (Example: Users requesting the URL of Devices for provisioning) and in the URL sent to the App services itself (Example: Devices uses this URL to construct the URL set at devices for the Devices registration).

: Note that this mode is intended to be able to run the PBX using DNS names while the DNS is not yet in place. Once the DNS is up and running, neither the DNS name of the AP nor its IP address should be configured here.

;Music On Hold URL: A URL for the Music On Hold. This file is read by the PBX using HTTP and sent to a held endpoint via RTP. The format of this URL is

:'''<nowiki>http://<addr>/<file>.$coder?coder=g711a,g711u,g722,g723,g729,opus-nb,opus-wb&repeat=true</nowiki>'''. <addr> is the IP address of the http server, no dns name is allowed here. <file> is the filename. $coder will be replaced by the actual coder used.

:Parameters: ''coder=g729,g711a,g711u,g723,opus-nb,opus-wb'' is the list of available coders. Only these coders must be specified for which a corresponding file exists. ''repeat=true'' should be specified in order to loop the file endlessly. ''random=true'' can be used to start the music on hold on a random point (this will work only if the URL is not local though).

:By default the built-in Music-On-Hold is played (Pseudo URL: "MOH?coder=g729,g711a,g723&repeat=true"). You can also play a dial tone (Pseudo URL "TONE") or a ring-back tone (Pseudo URL "TONE?tone=ringback").

:The maximum length of the URL is limited to 500 characters (bytes).

:If you configure a wrong (or invalid) URL then you will have silence as MOH. To prevent this situation when the MoH for some specific context/user(see below) is missing and silence is played instead of any MoH, an additional parameter ''fallback=true'' is available. If the file provided in the URL is missing (HTTP Error 404 Not Found is delivered by the HTTP Server) and the parameter ''fallback'' is provided, the default MoH will be played instead of silence. To use a custom file as fallback MoH, instead of default MoH, any file name can be provided with the ''fallback'' parameter: e.g. ''fallback=other_filename''. The file other_filename.g7xx must be placed in the same folder as a file provided with URL. A special filename ''fallback=ringback'' can be used to generate a ringback tone (equivalent to ''TONE?tone=ringback'') instead to play an alternative file.

:Within the URL %<id> can be used to put in some context information of the call. The information refers to the party which has put the receiving party on hold. For information about the receiving party itself, the id has to be preceded by '.' (e.g. '''.l''').

:'''l''' Long Name
:'''h''' Name (H.323 id)
:'''n''' Number
:'''N''' Node
:'''P''' PBX
:'''d''' Diverting Name
:'''#d''' Diverting Number

: See [[Howto:Dynamic_MOH]] for more details on how to use dynamic music on hold.

;External Music On Hold: To offload the device from playing the Music on hold, the Music On Hold can be played by a separate device. This device can register with a name configured here. To retrieve the Music On Hold a call is sent to this device. For each held endpoint a call is sent.

;Response Timeout: Global timeout (in seconds) after which any action for no response is taken (e.g. Call Forward on No Response). A timeout configured at any object overrides this value.

;Dial Complete Timeout: Global timeout (in seconds) after which any action for incomplete dialed number is taken (e.g. incomplete destination at trunk object).

;No. of Regs w/o Pwd: Number of registration without password authentication which are allowed per user. If 0 is configured no registration without password is possible.
Pls. note that registrations from 127.0.0.1 w/o password will be accepted anyway

;Security block time(s): Time for which a registration to a user is blocked after attempt with wrong password. Default is 20s. With a value of 0 this features is turned off.

;Recall Timeout: A value configured here enables recall after transfer. If a call is transferred and not answered within this time, the call is sent back to the transferring endpoint.

;No email as call destination: If checked an email address configured at a user cannot be used to call this user. This is useful, if there may be conflicts of email addresses with destinations to be called via federation.

;Chat no Attachments: If checked, no file attachments are allowed in chats for any user

;Retries on busy (14s): Number of retries (Each attempt runs for 14 seconds) of blind transfer to a busy endpoint, before a recall back to the initiator is executed. During an attempt, the PBX waits to see if the target is free, and then delivers the call. The default value are 4-retries if the field is empty. If there is a 0 configured no further (in addition to the initial) will be executed. (This function depends on the ''Recall Timeout'' so the ''Recall Timeout'' must not be empty)

;Max Call Duration (h): Number of hours until a call with media is disconnected automatically. Affects all calls with initialized media channels signalled via PBX.

;Group Default Visibility: Defines additional visibility for active group members. These are added to the visibility rights derived from the [[{{NAMESPACE}}:PBX/Objects/Visibility | Visibility settings]] in user or template definitions. Note that changes made here only take effect after a re-registration.

;Presence with Alert: Enable presentation of presence on phone upon alert. Setting applies for all PBX users.

;Enable External Transfer: Unless this checkbox is set any attempt to transfer an external call back to an external destination will result in disconnection of the call.

;No CLIR on Internal calls: If checked numbers are displayed even if received with presentation restricted. When sending a call presentation restricted can still be set and should be honored by a public network.

;Disable reconnect: Disables the automatic reconnect feature if a client lost or change the network. Available from 16r1sr4.

;Media Relay:
:;Off: No Media Relay is done in the PBX
:;On: All media traffic is routed through the PBX. With the '''No Media Relay if Addresses are identical or private''' checkmark, this is not done if the two call endpoints registration addresses are either private or equal (i.e. external endpoints behind the same NAT router). To identify an address as private the "Private Networks" configuration from ''IP4/General/Settings'' is used.
:;Auto: Media traffic is routed through the PBX if calls are between private and public registration addresses but not for calls between private and private or public and public registration addresses. To identify an address as private the "Private Networks" configuration from ''IP4/General/Settings'' is used. In v11 this was the behaviour if ''RTP Proxy'' was ''on''.
: Please note that when media relay is in effect for a call, '''video is not working'''. With ICE (available from v12r1), media relay in the PBX should be obsolete except for special applications. Check ''On'' or ''Auto'' only if you need to have this, since it creates CPU load on the PBX.

;Generate CDRs: If this checkbox is set, the PBX generates CDRs for all calls. For details, refer to the [[{{NAMESPACE}}:Concept_Call_Detail_Record_CDR_PBX|CDR description article]].

;Reverse Lookup URL
: A String in the LDAP URL Format according [https://tools.ietf.org/html/rfc2255 RFC2255] which will be used by the PBX to make a lookup for all external numbers.
: Number resolutions will be forwarded to internal applications like generated CDRs, Phone App etc..
: Example: ''ldaps://ap.innovaphone.com/dc=entries?givenname,sn,company?sub?(metaSearchNumber=+%n)?bindname=innovaphone.com\contacts''
:* dn: ''dc=entries''
:* attributes: ''givenname,sn,company''
:* scope: ''sub''
:* filter: ''(metaSearchNumber=+%n)''
:** %n is a placeholder for the given cgpn
:* extension: ''bindname=innovaphone.com\contacts''
:** The username for the authentication.
:'''Variables'''
:* %n - cgpn
:* %u - h323 name of the current object
:'''Password''': Password to authenticate access for the used ldap source. Leave empty if not required.
: Examples for use of different ldap directories are listed in the [[{{NAMESPACE}}:Concept_Number_Resolution_and_LDAP#PBX_Configuration|Concept Article]]

;Logo URL
:The URL to a customized logo image that will be displayed on the phones. Leave empty to keep the standard logo. The image size should be 220x150px or less with 24Bit color deep or less and an RGB range. The file format should be PNG or JPEG.

;Route Root-Node External Calls to: Destination object (Long Name) of Root-Node external calls. This configuration option is available on the Master or Standby PBX only. Any call which cannot be terminated inside the PBX is sent to this destination as long as neither the source nor the destination of the call can be associated with a node with a PBX configured. This object must be assigned to this PBX.
:'''For calls from local PBX only''': If set on a master, calls from a slave are not sent to this destination but sent back to the slave where the call came from. On the slave the call is then sent to a destination configured with 'Route Root-Node External Calls to'.

;Route PBX-Node External Calls to: Destination object (Long Name) of PBX-Node external calls. Any call which cannot be terminated inside the PBX is sent to this destination as long as the source nor the destination of the call can be associated with the node of this PBX. If a call is sent from or to an object defined inside the node of this PBX or in a node hierarchically below the node of this PBX the call is associated to the node of this PBX. This object must be assigned to this PBX, that is, it has to register to this PBX.

;Route Internal Calls to: Destination object (Long Name) to which any call is sent for which a PBX internal destination was found, except for those calls that originated from that object. This can be used to apply special routing on PBX internal calls.

;Escape Dialtone from: The PBX object (Long Name) to which a call is made to get a dialtone if a dialtone is configured for the escape of a node. As above, this object must be assigned to this PBX.

;Prefix for Intl/Ntl/Subscriber/Area-Code/Country-Code: Prefixes to be used to map International, National and Subscriber numbers.
:* '''International Prefix''' (<code>000</code> in Germany).
:* '''National Prefix''' (<code>00</code> in Germany).
:* '''Subscriber''' (in Germany, <code>0</code> is a commonly used trunk line access code).
::The SubscriberID is used for hotkey-actions within myAPPs-launcher. By use of node-objects, adjust the Subscriber Prefix in the respective [[{{NAMESPACE}}:PBX/Objects/Node#Number_Mapping_.28International.2C_National.2C_Subscriber_Prefix.29|node object number mapping]].
::For myPBX-launcher hotkeys, refer to the [[{{NAMESPACE}}:Phone/User/Directories#Dialing_location|dialing location settings]].

:* '''Area-Code''' (in Germany for example, the town Mannheim has area code <code>621</code>).
:* '''Country-Code''' (for Germany, <code>49</code> would be used)

: These settings resemble the same settings found in the [[{{NAMESPACE}}:PBX/Objects/Node | Node]] and [[{{NAMESPACE}}:PBX/Objects/PBX | PBX]] object. However, they apply to the ''root'' node instead (and should be consistent through all PBXs in a multi-PBX system).
'''Max. length internal number'''

If the dialled number is 7 digits or longer, the subscriber prefix is added. Applies to phone and softphone app. PBX and myApps must be reset following the change. Refer to the [[Reference13r1:Concept_Number_Adjustments_(Dialing_Location)#Phone_App,_Softphone_App|respective concept]].
;Adjust LDAP results for e.164: Add a "+" prefix to an PBX-internal LDAP-contact-search result. This is used for 3rd-party- and DECT-phones which are not able to benefit from the Dialing Location settings in case of LDAP-search in an E.164-setup. See also [[{{NAMESPACE}}:Concept_Number_Adjustments_%28Dialing_Location%29#PBX_database_used_as_LDAP_database|concept description]].

;Tones: The tones scheme to be used for PBX generated dialtones. This applies to dialtones generated for node prefixes, ringback on transfer and some more.

=== Slave PBX ===

If the PBX is operated in Slave mode, then the Slave PBX section is displayed

;Registration: The VOIP protocol used for the registration to the master. Possible choices are H.323, H.323/TCP or H.323/TLS.

;Master: The IP address of the PBX master

;License Only: If set, the PBX obtains license from master, but acts as master in all other respects.

;Alternate Master: The IP address of an alternative PBX master (standby, if available)

;Password: The password to be used for registration at the Master as configured in the corresponding PBX Object (The length of the password is limited to 16 characters)

;Master GK-ID: The System Name/Gatekeeper ID of the PBX Master were will register (Optional, usually used for DynPBX).

;Replication: This parameter allows you to select the replication style for the slave PBX: either ''All'' or ''Local'' (only users that need to be known in this PBX). For the replication process the [[Reference9:PBX/Config/Security|PBX Password]] is used which have to be the same password on all PBXes in the system.

;dyn PBX ID: This parameter allows to set replication from a specific DynPBX configured on the Master Device.

;Use local static User DB: A dynPBX has also this checkmark. The database of the main PBX is used, but be careful due to the increased memory usage. The dynPBX will create its own PBX datastructure which allocates memory.

;Route Master calls if no Master to: If the master is not available, master calls are sent to this destination. Destination has to be an object with active registration.

;Max Calls to Master/No Reroute: This parameter can be used to limit the calls to the master. If a call is sent to the master and there are already calls to/from the master equal to or exceeding this value, the call is rejected if '''No Reroute''' is set or is handled as if the master was not available otherwise.

;License Limits: Here we can set limit of licensing for this Slave PBX for Port, Mobility, Operator and Softwarephone.

For complete replication from master to slave, check also password in [[Reference9:PBX/Config/Security#PBX_password]]

=== Standby PBX ===

If the PBX is operated in Standby mode, then the Standby PBX section is displayed

;Master: The IP address of the PBX master

;Replicate from Master: Turns on full replication from the master PBX

;use TLS: Use LDAPS (TLS) instead of LDAP (TCP).

For complete replication from master to slave or standby, check also password in [[Reference9:PBX/Config/Security#PBX_password]]

Reference16r1:Concept App Service Connector for Microsoft 365

2026-08-11T14:01:36Z

Vsc: /* Concept */

[[Category:Concept|Apps]]
== Applies To ==

* Connector for Microsoft 365 from Version 16r1

= Overview =

Connector for Microsoft 365 synchronizes Microsoft Teams presences with the innovaphone PBX and back, and optionally additionally Calendar presence from Exchange Online (part of the Microsoft 365 Cloud Services).
It is also possible to search for your own contacts.

== Requirements ==

* innovaphone PBX
* innovaphone Application Platform (minimum version 120004)
* V16r1
* App(Connector for Microsoft 365)
* PBX-App(innovaphone-microsoft365) license per user - order no. 02-00050-009

== Concept ==

=== User Presence ===

==== Configuration ====
Please have a look into our [[Howto16r1:Configure User Presence Sync by Connector for Microsoft365|Howto guide for basic configuration aid on user presence synchronisation]].

==== Technical Overview ====
If the Connector for Microsoft 365 app is fully configured, the app connects to Microsoft to obtain a token. With the token, the app gets the teams users (with a Teams license) through the Microsoft Graph API.
A presence subscription to Microsoft is started with the licensed users of the PBX to get presence changes in Microsoft Teams for these users. A user subscription is also started to get changes of the users (adding, deleting or update). If a user has changed, the Teams users are retrieved again. If the presence has changed, it is forwarded to the PBX. The presences of Teams are mapped to the presences of the PBX.

* User subscriptions are renewed every 60 minutes.
* Presence subscriptions are renewed every 10 minutes.
* License Check is made periodically.

The app synchronises the PBX presence with Teams through the Graph Api. The on-the-phone presence will be renewed every 5 minutes. The other presences have a lifetime of 1 day but the away has a lifetime of 7 days.
The lifetimes are described [https://learn.microsoft.com/en-us/graph/api/presence-setuserpreferredpresence?view=graph-rest-1.0&tabs=http here]

'''Please be aware:''' The actual change of presence or line state will be live, the above-mentioned subscriptions are needed to register against the Microsoft API for changes.
After successful subscription Microsoft will trigger the Connector for Microsoft 365 App every time a presence or line state for a user has changed.
The subscription will then be renewed in the above-mentioned time interval to receive further live updates.

===== User Matching =====
You now can choose the fields used for user matching on either side from the following options:
* PBX
** CN (Long Name property from the PBX user object)
** h323 (Name property from the PBX user object)
* Azure Portal
** displayName
** mail
** mailNickname
** onPremisesDistinguishedName
** onPremisesSamAccountName
** onPremisesUserPrincipalName
** userPrincipalName

Additionally, you have the possibility to remove a possibly contained domain from the Azure fields content. 
Example: 'user@domain.tld' is transformed to 'user', if this option is checked.

===== Mapping Table =====

{| class="wikitable"
|-
! Teams Presence
! PBX Presence
|-
| Away
| away
|-
| BeRightBack
| away
|-
| Busy
| busy
|-
| DoNotDisturb
| dnd
|-
| InACall
| on-the-phone
|-
| InAMeeting
| meeting
|-
| Inactive
| online
|-
| PresenceUnknown
| online
|-
| Available
| online
|-
| Offline
| online
|-
| Offwork
| online
|-
| OutOfOffice
| away
|-
| UrgentInterruptionsOnly
| dnd
|-
| Presenting
| on-the-phone
|-
| InAConferenceCall
| on-the-phone
|}

The value "online" unsets the Teams presence in the PBX.

===== Master/Slave =====

For Master/Slave combination the "Connector for Microsoft 365" App has to be added to the slave (if no full replication is on). The slave websocket connection is needed to display "on-the-phone" presence.

=== Calendar Presence ===

==== Configuration ====
Please have a look into our [[Howto16r1:Configure Calendar Presence Sync by Connector for Microsoft365|Howto guide for basic configuration aid on calendar presence synchronisation]].

==== Technical Overview ====
Introduced in 15r1 the Connector for Microsoft 365 will offer a possibility to sync Azure Portal calendar events (Teams, Exchange online) via the Graph API with the PBX presence. 
For now the [https://wiki.innovaphone.com/index.php?title=Reference13r3:Concept_App_Service_Calendar Calendar App] is (along with other functions) also capable of syncing calendar events, but using the old EWS mechanism, which Microsoft announced as end of life starting from 2026. 
'''Warning:''' Please make sure to not use both apps for syncing calendar events in parallel, this is not supported and will most likely lead to conflicts and unexpected behaviours. 
 
When the configuration of the connector for Microsoft 365 Calendar Presence Sync is complete, the app connects to Microsoft to receive a token with the calendar app registered in the Azure portal. 
With the token, the app can pick up the users from the Azure portal. 
These are matched against the users in the PBX, based on the configured "User Assignment" settings. 
For each matched user with a valid Connector for Microsoft 365 licence applied, a subscription for calendar events is created at Microsoft to receive event changes in Microsoft Calendar for these users. 
 
A user subscription is also started to receive user changes (add, delete or update). 
If a user has changed, the users are retrieved again. 
 
If a calendar event has been started or ended, it is forwarded to the PBX. 

* User subscriptions are renewed every 60 minutes.
* Event subscriptions are renewed every day.
* License Check is made every hour.

=== Contact Search ===

==== Configuration ====
Please have a look into our [[Howto16r1:Configure_Contact_Search_by_Connector_for_Microsoft365|Howto guide for basic configuration aid on contact search]].

==== Technical Overview ====
Introduced in 16r1 the Connector for Microsoft 365 will offer a possibility to search for your own contacts (Teams, Exchange online) via the Graph API.

When the configuration of the connector for Microsoft 365 Contact Search is complete, the app connects to Microsoft to receive a token with the contact search app registered in the Azure portal. 
With the token, the app can pick up the users from the Azure portal. 
These are matched against the users in the PBX, based on the configured "User Assignment" settings. 
For each matched user with a valid Connector for Microsoft 365 licence applied, the user can search with the Phone App, for example (a myApps search provider will be provided for all apps looking using search providers looking up contacts). The search string is made available to the Connector for Microsoft 365 via the microsoft365-api. The results are sent to the consumer, e.g. the Phone App and presented there. 
 
A user subscription is started to receive user changes (add, delete or update). 
If a user has changed, the users are retrieved again. 
 

* User subscriptions are renewed every 60 minutes.
* License Check is made every hour.

'''Be aware:''' Since the Connector for Microsoft 365 is an app in the Scope of myApps App Platform, IP Phones and other services not using Apps cannot benefit from this search service.

== Related Articles ==

=Known Limitation=

== General ==
''Applies to the User Presence and the Calendar Presence''

=== Synchronization Delay ===
In the official Graph-API documentation, Microsoft is providing an overview about expected latencies for change notifications. 
You can find a whole overview table here: 
https://learn.microsoft.com/en-us/graph/change-notifications-overview#latency 
 
For the user presences the resource "presence" is used and an average latency of 10 seconds but a maximum up to 1 minute is provided. 
Such a delay in syncing changed presences from Teams down to the PBX are considered normal and are caused by the Microsoft Graph-API. 
 
In case of calendar events the average is provided as "less than 1 minute" and the maximum to 3 minutes. 

== User Presence ==
=== Line states set by the PBX does not block calls in Teams ===
Line states set by a 3rd party application (like the Connector for Microsoft 365) through the graph API are currently '''only for display purpose and do not block new calls''' in Teams. 
 
https://techcommunity.microsoft.com/t5/teams-developer/ms-graph-setpresence-problems/m-p/2798805/highlight/true#M3957 
As you can see in the above linked discussion, there once existed a feature request on Microsoft Voice, which is no longer available since it was not voted.
=== Maximum number of supported users ===
The connector now supports multiple Microsoft Teams communication users, which is the prerequisite to subscribe for more than 650 users. There is a new ribbon (Manage Teams Accounts) that allows you to configure as many communication users as you need. Every configured communication user can be used to subscribe 650 users, for example:

*3 configured communication users x 650 licensed users = 1950 users can be subscribed
'''Please be aware''': Each communication user must have a Teams license applied.

This limitation is caused by Microsoft. 
In the documentation of the Graph-API you will find a hint to this limitation: 
https://learn.microsoft.com/en-us/graph/changenotifications-for-presence#subscribe-to-multiple-users-presence 
Trying to subscribe more than 650 users (with one communication user) by using the presence subscription API will be declined by the graph API with an error message, that too many users are requested. 

=== Communication User (UserSynctoPbx) ===
Users with multi-factor authentication (MFA) are not supported as technical communication users for the Connector.

''We recommend creating a dedicated user account for this purpose rather than using an existing user account.'' 
''This limitation applies only to technical users used for the Connector for Microsoft 365, not standard user accounts. MFA can be used for real users.''

=== Multiple sites / instances require multiple communication users ===
Each instance or each site must have separate communication users, as Microsoft only allows one concurrent subscription per communication user. (otherwise an HTTP 409 conflict will occur)

This means that if you want to subscribe to the same Azure Portal backend from two different sites (or instances), you will need to have multiple communication users (each with an applied Teams licence) in order to be able to subscribe from all endpoints.

=== Subscription Timeout ===

==== Situation ====
Due to a current limitation in the Graph API it is not possible to cancel or delete an active presence subscription. 
As you can see in the [https://learn.microsoft.com/en-us/graph/api/subscription-delete?view=graph-rest-1.0&tabs=http|documentation of the current Graph API (1.0)] the “Delete subscription” chapter does not include presence subscriptions. 
It is also not possible to have multiple subscription in parallel. 

To make sure to only request a new presence subscription when the old one is not valid anymore, the app will store the state of the presence subscription and the time until it is valid in the database. 
As mentioned in the chapter “Technical Overview” we are creating presence subscriptions with a validity of 10 minutes. 
The presence subscription will be renewed as soon as it is no longer valid which will be 10 minutes after initial subscription. 

==== Impact ====
If settings are changed or the app instance is restarted it will check the corresponding database entry on startup. 
In case the last presence subscription was completed less than 10 minutes ago, there is still an active presence subscription and the app has to wait for it to become invalid. 
Some Changes (e.g., to the “Notification-URL”) will only take effect after a new created subscription. 

The current Beta Version of the Graph API is already providing a function to delete presence subscriptions, so we hope we can improve this behavior in the future. 

=Troubleshooting=
== General ==

===Creating an app trace===
For further analysis and creating a support ticket it will be useful to have a suitable app trace. 
Before creating the trace please make sure the following trace flags are activated for the app instance:
* App
* App WebSocket
* Config
* Database
* HTTP client
* TCP
* TLS
* Webserver

After setting the config flags, please make sure to
* stop the instance
* deleting the current instance log
* start the instance
'''Now please wait at least 5 Minutes before you save the log''', otherwise we could not have the whole picture in the trace.

The restart and deletion of the the old log is useful the see the complete initialization process right away.

===SSL Certificate for notification URL===
It also is useful to make sure the notification URL has a valid and public signed certificate. 
You can do that, using an SSL-Checker, for example: https://www.sslshopper.com/ssl-checker.html 
Without a valid, public signed certificate, Microsoft will decline the connection since it will not be possible to establish a trust relationship for the SSL/TLS secure channel.

===Correctness of notification URL===
You can try to open the notification URL in your Browser 
Most likely you will see a HTTP 404 (Not Found) error message, which is the expected behavior since we are not providing an HTML website, the HTTP GET request from the browser will not be answered with content. 
This is perfectly fine since Microsoft will send presence updates with HTTP POST and will not try to request content from our app. 
 
What you can find out by trying to open the URL in your browser are the two following things: 
* If you receive a HTTP 404 error message you are most likely connected to an App Platform, if not you need to check your DNS (and maybe also reverse proxy) settings.
* If the URL is modified and the used build number is added, an app has answered your request
** Example: <code>https://public.dns/your.domain/microsoft365/subscriptions</code> is modified to <code>https://public.dns/your.domain/microsoft365/1510411/subscriptions</code>
** If this is not the case, your URL is wrong. (Be aware: The URL depends on the settings of the web server path of your app instance)

'''Be aware:''' The URL-Recognition in the Application Platform is '''case sensitive'''.

=== Activation of "Public client flow" for the registered app in Azure Portal===
If the subscription is not working at all, please make sure "Public client flow" is activated for the registered app in the Azure portal (as described in our [[Howto16r1:Configure User Presence Sync by Connector for Microsoft365#Create an App for syncing Teams to PBX|HowTo article]]). 
 
The App Service trace will contain the following message if this is not the case: 
<code>AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'.</code>

== User Presence ==
===GUI Feedback===
The app itself shows required states with green and red as connections to the Master PBX, Authentication and Presence Subscription to identify if there are problems. 
Sometimes it needs a little bit time until the states are changed. 
If the states remain, it is mandatory to enable logs on the app platform and check for more information. 
([[Howto13r3:Configure Connector for Microsoft365#Creating an app trace|Concept App Service Connector for Microsoft 365: Creating an app trace]])

====No connection to Master PBX====
Check the MasterPBX name. 
The field must only contain the name [pbx], '''not the full domain''' [pbx.domain.tld]. ([[Howto13r3:Configure Connector for Microsoft365#Synchronization from Teams to the PBX|Synchronization from Teams to the PBX - Master PBX field]])

====Presence subscription failed====
There are many reasons why the "Presence subscription failed" message could be displayed. 
We try to list the most common reasons:
* The permission for the registered app in the Azure portal are not correctly set ([[Howto13r3:Configure Connector for Microsoft365#Create an App for syncing Teams to PBX|Howto: Create an App for syncing Teams to PBX]])
* The Notification URL is wrong ([[Reference13r3:Concept App Service Connector for Microsoft 365#Correctness of notification URL|Concept App Service Connector for Microsoft 365: Correctness of notification URL]] )
* The App service is not reachable from the internet ([[Reference13r3:Concept App Service Connector for Microsoft 365#Correctness of notification URL|Concept App Service Connector for Microsoft 365: Correctness of notification URL]] )
* The certificate for the public endpoint (e.g. reverse proxy) is not valid, or not publicly signed ([[Reference13r3:Concept App Service Connector for Microsoft 365#SSL Certificate for notification URL|Concept App Service Connector for Microsoft 365: SSL Certificate for notification URL]])
* The user from PBX and the Azure Portal cannot be matched ([[Reference13r3:Concept App Service Connector for Microsoft 365#User Matching|Concept App Service Connector for Microsoft 365: User Matching]])
* The App Platforms clock time is wrong ([[Reference13r3:Concept App Service Connector for Microsoft 365#App Platform clock time is wrong|Concept App Service Connector for Microsoft 365: App Platform clock time is wrong]])
* No user has a valid Connector for Microsoft 365 App license ([[Reference13r3:Concept App Service Connector for Microsoft 365#Requirements|Concept App Service Connector for Microsoft 365: Requirements]])

===Teams License for communication user===
If presence subscription does not work, please check if all of the configured communication users have a Microsoft Teams license applied and no multifactor authentication is in use for this particular user. 
Also please make sure you can login with the configured credentials. (If you have set a password as an Administration, the user needs to change the password during the first login, therefore the given password will be invalid for API access). 
''Sometimes, after changing setting or after the instance has restarted it can take up to 12 minutes until the presence subscription is working correctly. (Due to the subscription timeout)''

= Known Issues =
== Special Characters In Password ==
If you are using special characters (*, &, (, ), etc.) in your password you could run into a problem with the authentication of the communication user. 
The authentication failed status is being displayed. 
For the moment the only workaround is to eliminate special characters from your password.

==App Platform clock time is wrong==
If the clock time at the App Platform is not correct, this will lead to an unstable behaviour of the Connector for Microsoft 365. 
Since the Connector for Microsoft 365 is using the Microsoft Graph APIs presence subscription function, it needs to provide in its request a precise time until the subscription validity will be expired. 
The app service is handling subscription and will automatically recreate a new subscription each time the previous one has expired. 

A wrong clock time will lead to false expiration times and thus
* the subscription will be expired earlier than expected (synchronisation is not working because there is no valid subscription)
* the subscription will be valid longer than expected (the app service is trying to create a new subscription because it is expecting the previous one to be expired - will lead to a 409 conflict error, because only one subscription can be valid at a time)

If you are not sure about the current time of the App Platform, you can login via SSH into the App Platform and execute the <code>date</code> command to check the current time. 
You will receive an output like:
Tue Mar 12 13:38:57 UTC 2024
Please be aware: The time is displayed in UTC, so please make sure to convert to your local time zone.

==Geoblocking==
Since there might be no reliable country assignment for Microsoft addresses, all Microsoft addresses must be enabled on the upstream firewall in the event of geoblocking in order to ensure functionality of the Office365 Connector. 
As an alternative you might be able to configure your firewall to bypass the geoblocking for the configured notification URL.

= Related Articles =
[[Howto16r1:Configure User Presence Sync by Connector for Microsoft365]] 
[[Howto16r1:Configure Calendar Presence Sync by Connector for Microsoft365]] 
[[Howto16r1:Configure Contact Search by Connector for Microsoft365]]

[[Category:Howto|{{PAGENAME}}]]

Reference16r1:Concept App Platform

2026-08-10T13:11:45Z

Vsc: /* Security */

= General =
* V16 uses [https://buildroot.org/ buildroot]
* this is an own (innovaphone) collection of packages
* For further information see: [https://buildroot.org/docs.html Buildroot Documentations]

== Requirements ==

* V13 or above
* Gateway (arm): IPx10 (with CF card) or IPx11 (with mSATA SSD)
* Gateway (arm64): IPx13 (with m2 SSD)
* Virtual (x86_64)
** HyperV with [https://docs.microsoft.com/de-de/windows-server/virtualization/hyper-v/deploy/upgrade-virtual-machine-version-in-hyper-v-on-windows-or-windows-server#supported-virtual-machine-configuration-versions VM-configuration Version] 6.2 (minimum: Windows 10 or Windows Server 2016)
** VMWare
** Proxmox/KVM/Qemu

== Default credentials ==

'''During INSTALL, the default passwords are replaced with the global Admin PW!'''
* SSH-Login with '''admin''' and '''ipapps'''
* root login with '''root''' and '''iplinux''' (the root login is not directly possible, you have to login as admin first and use the command ''su root'')
* manager App (web login) '''pwd'''

= App Platform - arm/arm64 (Gateway)=

* The installation image has a size of ~50MB. During installation, the following partitions are created<ref name="partition-size">Maximum partition sizes are given. The real sizes are returned by the linux 'df -h'-command. These real values will be lower, but can grow in the future with new releases.</ref>:
** /dev/sda1 fat32: 200MB (contains ramdisk, rootfs and kernel)
** /dev/sda2 ext4: depends on disk size (contains databases, log files and apps)
** /dev/sda3 ext4: 500MB (contains the rootfs)
** /dev/sda4 swap: 512MB

When comparing potential performance of the IPxx11 platform compared to the IPxx10 platform, there are some major differences:
* SSDs found in the xx11 are faster and more reliable than the CF found in the xx10
* the available RAM for the App Platform (as specified in column ''RAM for LAP (GB) out of RAM'' in chapter ''Technical data and recommended number of users supported'' of [[Howto:How to implement large PBXs#Technical data and recommended number of users supported|How to implement large PBXs]]) is factor 6 larger on the xx11 (1,536 GB) than on the xx10 (0,256 GB))
* the xx11 has gigabit Ethernet while the xx10 has 100Mbps Ethernet. The xx10 is therefore not well suited for Apps with larger network traffic, such as Recordings
* the CPU of the xx11 (although it runs on the same frequency) is roughly 20% faster than the xx10

While it is hard to predict the performance of the App Platform in a specific scenario, we see that in a real life environment an App Platform running on an xx11 platform can well support 150 users. The xx10 platform is estimated to support 120 users. Because CPU performance is the limiting factor, larger setups can be built based on the virtual machine platform (see [[#App services and multi-threading|App services and multi-threading]] below).

<references/>

= App Platform - x86-64 (Virtual Machine 64bit) =

* The default disk size is 16GB. It should be increased '''before''' the first start if needed!
* Multiple CPUs are supported, default is one CPU
* default RAM: 512MB
* static IP address, DNS, Gateway can be configured with the command '''setip''' on the console. Run '''setip --help''' to get a list of parameters. (Example: setip --addr=x.x.x.x --mask=x.x.x.x --gateway=x.x.x.x --dns1=x.x.x.x)
* If you have permission problems change to su user (Password is iplinux or your new admin password)
* To figure out your ip address you can use the command: ''ip address'' on the console.
* '''loadkeys de''' can be used to change to german keyboard layout (etc.)
* partitions<ref name="partition-size">Maximum partition sizes are given. The real sizes are returned by the linux 'df -h'-command. These real values will be lower, but can grow in the future with new releases.</ref>:
** /dev/sda1 ext2: 350MB (contains ramdisk, rootfs and kernel)
*** the real partition format size is smaller but there is no need to monitor sda1 as sda1 won't grow during usage of the App Platform
*** sda1 is completely exchanged during an image update and its size might have changed but will never exceed these 350MB
** /dev/sda2 ext4: depends on disk size (contains databases, log files and apps)
** /dev/sda3 ext4: 500MB (contains the rootfs)
** /dev/sda4 swap: 512MB
* VMWare Tools: Open VM Tools
* Qemu Guest Agent: installed since 110032
** The qemu guest agent can be configured in Proxmox with ''Virtio'' or ''ISA''. Before version 130012, you must use ISA, as Virtio was not supported with older versions.

<references/>

= Installation =
==ARM Gateway==

If you setup a Gateway with the install procedure, the App Platform is installed automatically (Https Download has to be allowed and shouldn't be blocked by any firewall.) 
You can also install it manually:
* Open App Platform -> General and '''Enable Linux Support'''. Restart the gateway.
* You need to enable Proxy-ARP on [[{{NAMESPACE}}:IP4/ETH/IP|ETH0]] or [[{{NAMESPACE}}:IP4/ETH/IP|ETH1]], so your Gateway and the Linux Appliance will share the same physical interface.
* Open App Platform -> IP and configure the IP settings of the App Platform. Restart the Gateway.
* Open App Platform -> Installation and select the given version or enter an own path to the ''app-platform-armel.img'' image file.
* The installation runs without any further required step.

==ARM64 Gateway==

If you setup a Gateway with the install procedure, the App Platform is installed automatically (Https Download has to be allowed and shouldn't be blocked by any firewall.) 
You can also install it manually:
* Open App Platform -> General and '''Enable Linux Support'''. Restart the gateway.
* You need to enable Proxy-ARP on [[{{NAMESPACE}}:IP4/ETH/IP|ETH0]] or [[{{NAMESPACE}}:IP4/ETH/IP|ETH1]], so your Gateway and the Linux Appliance will share the same physical interface.
* Open App Platform -> IP and configure the IP settings of the App Platform. Restart the Gateway.
* Open App Platform -> Installation and select the given version or enter an own path to the ''app-platform-arm64.img'' image file.
* The installation runs without any further required step.

==Virtual machine==

* Import the image into your server environment.
** Proxmox: follow this description here, just with the app-platform-ova.zip: https://wiki.innovaphone.com/index.php?title={{NAMESPACE}}:Concept_Innovaphone_Virtual_Appliance#Proxmox_VE
* Edit the disk size, if needed.
* Start the machine and wait until it reboots and starts again.
* Note: If you need to access an IP addresses available through a VPN connection from from inside the virtual machine, it could be that you need to set the network of your VM to NAT (and also add the URL for an IP to /etc/hosts)

[https://wiki.innovaphone.com/index.php?title={{NAMESPACE}}:Concept_Innovaphone_Virtual_Appliance#Configuration More Configuration Hints regarding VM Ware]

== Backup of the Apps ==

Each App Service can have multiple instances and each instance has its own database. The manager app itself also has its own database. 
There are no other files which need to be backuped. 
The standard way to backup the databases is through the Devices App [[{{NAMESPACE}}:Concept_App_Service_Devices#Backups]]. 
 
An alternate way is to use a command file which is similar to the command files from the firmware.

===Commands===
* '''times''' 0,12 # backup only at 0 or 12 o'clock
* '''backup-instances''' http://user:pw@ip/path/#I-#D.dump PUT
** PUT and POST are supported, all instances including the manager itself are saved
* '''backup-instance''' http://user:pw@ip/path/#I-#D.dump apidemo example.com PUT
** backup a single instance with instance name and instance domain
* '''backup-manager''' http://user:pw@ip/path/#I-#D.dump

===Hash parameters===
* #L App Platform label (neu), e.g. 10024
* #A App label (neu), e.g. 130004
* #I instance name (neu), e.g. reporting1
* #D instance domain (neu), e.g. innovaphone.com
* #m MAC address of the LAP, e.g. 00ab11eeff
* #d Current date and time (plain UTC without daylight saving and timezone adjustments) 20051010-170130
* #bn rolling backup index (n >=0 and <= 9, just one digit)
* ## escapes a hash mark

= App Platform Infrastructure and Concept =
== Webserver ==
The app platform includes a webserver that is highly optimized for handling many Websocket connections at a low memory footprint.
All apps use that webserver by registering for specific HTTP subpath. So they can all use the same HTTP/HTTPS ports - typically the standard ports.

=== Import Custom SSL Certificate ===
You have to upload a PEM Certificate with the following chain structure and without password encoding.

-----BEGIN CERTIFICATE-----
(certificate: eg. your_domain_name.crt)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(Intermediate certificate: eg. DigiCertCA.crt)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(Root certificate: eg. TrustedRoot.crt)
-----END CERTIFICATE-----
-----BEGIN RSA PRIVATE KEY-----
(certificate Key: eg. your_domain_name.key)
-----END RSA PRIVATE KEY-----

If you have problems generating the complete and correct certificate chain, you can use tools such as https://whatsmychaincert.com/ as an aid.
'''Please keep in mind that you never give away the private part of your key.'''

=== Known issues ===
*The app platform webserver can use only the default http/https ports 80/443.
*By design, there is no possibility to restore the default webserver certificate on the App Platform, if another certificate was once uploaded. 
**If nevertheless needed, you must login with Putty (see [[#How to retrieve files from the AP| Retrieve files]]) and execute these commands as root:
**''psql -d manager -c "DELETE FROM config WHERE name='webserverCertificate'"''
**''/etc/init.d/S92manager restart''
*The app platform webserver interprets URLs case-sensitive. In other words, <nowiki>http://<addr>/file.txt</nowiki> is not the same as <nowiki>http://<addr>/FILE.TXT</nowiki>

== Database ==
The app platform creates a database for each app instance with a given password. In the installer there will be used randomly generated passwords. You can set a new database password for every instance in the Application Platform.

The apps should store all data in that database. That makes sure that a consistent backup and restore of app instances can be done by the app platform manager.
In hosted scenarios, having separate databases for each instance also makes sure that the data of different customers are clearly separated and can easily be moved from one physical platform to another.

The default configuration decline database request from extern. If you need external access you can change the PGSQL configuration (as root) in the file ''/mnt/sda2/pgsql/pg_hba.conf''.
After editing pg_hba.conf, the database-service has to be restarted with the command <code>/etc/init.d/S50postgresql restart</code>
(Please think about it before you do it, because a better way is to create your own local app with local database access.)

You can find the official documentation for the pg_hba.conf here: https://www.postgresql.org/docs/14/auth-pg-hba-conf.html

Please note that you do this on your own responsibility, that it makes sense to create a backup of the original pg_hba.conf
and that you may break your database server if you do not know exactly what you do!

Sometimes the Apps are not proper working after this. You can wait a while until everything is working again or you go the hard way:
* stop the manager
** <code>/etc/init.d/S92manager stop</code>
* restart the database-service (maybe not really necessary, but makes a good feeling)
**<code>/etc/init.d/S50postgresql restart</code>
* start the manager
** <code>/etc/init.d/S92manager start</code>

=== Nightly database analyse ===

Every database is analysed at night to keep indexes in sync with the data. This triggers a ''vacuumdb -a -z'', which updates optimizer statistics, but does '''not''' shrink the physical size of the database. 
This must be done manually in the instance settings.

== App Platform Manager ==
The App Platform Manager is the central component of the App Platform. It does the following:
* Installing app services by downloading the binaries from an app store.
* Running and monitoring app services. If an app service crashes it is restarted, automatically.
* Management of app instances and providing them with the environment they need:
** A database
** A webserver path
** A password for authentication
* Backup and restore of app instances.
* Collecting debug information like tracing and crash dumps.
* System monitoring (CPU usage, memory usage, etc).

== App Services ==
App services are runned by the App Platform Manager. They implement an interface that is used by the manager to start, stop and configure app instances. Each service runs in a separate child process of the manager.

== App Instances ==
The actual functionality of an app service is provided by app instances. They run in the same process as the app service but have a distinct webserver path and their own database. There can be 0..n instances of an app service. Instances can optionally host (web) apps that can be opened in the myApps client.

Each instance of an App service has two passwords. The instance password itself and a database password. If you want to change it you must update the password on both sides. 
The instance password must match to the password in the corresponding PBX App objects, while one instance can have different App objects. 
The database password must be just known to the manager and not outside of the App Platform.

The ''Database name'' and ''Database user'' are both limited to a length of 63 characters. By default, the App Manager would create ''<domain>''_''<instance-name>'' as value for both. This is why it is recommended to use instance names so that length(name) + length(domain) is less than 63 characters. However, if this is not possible, you can manually shorten the suggested values (both must still be unique on your App Platform).

=== Cleanup database ===
You can cleanup the instance database inside the instance settings. This starts the vacuumdb process for the instance database which frees disk space of deleted rows.
Note that this process locks the database and that sufficient disk space is needed to complete it!

=== External database host ===
You can optionally configure an external database host, if the database shall be hosted on an external host. 
Note that the App Platform Manager still creates a local database, which is then not used as long as the external host is configured.

What are external databases useful for?:
* User data is too large (files are stored as BLOB in the database)
* Other (non-innovaphone) database servers are to be used due to other regulations
* There is already an external database cluster with its own backup/restore processes which should be used
* More performance is required (please note that a local UNIX socket provides much faster results than a remote database server). Depending on the app and the task of the app, it can still be useful to use a separate server if it is faster.

==== Supported database types ====
In principle, ''PostgreSQL'' and ''MySQL'' are supported. However, please note that the respective app must be designed for the target database server type. If an app has been developed for PostgreSQL, it cannot be operated on a MySQL server.

'''Please note:''' All innovaphone apps are developed exclusively as PostgreSQL apps.

MySQL therefore only makes sense if own apps are developed and MySQL or certain MySQL features are to be used. For such apps, it is very important to deactivate the automatic Application Platform APP-Backup.
The database backup process of the App Platform uses PostgreSQL backup commands, which is why the backup would fail, so the app must be excluded from the backup, and you must take care of the backup yourself.

==== Database creation ====
If you use an external database, you have to create the database itself.
The App Platform Manager itself creates a PostgreSQL database like this (you may respect this on your database host to be compatible with the database implementation inside the Apps):
* CREATE DATABASE "dbname" ENCODING 'UTF8';
* CREATE USER "dbuser";
* ALTER USER "dbuser" WITH PASSWORD 'dbpassword';
* GRANT ALL PRIVILEGES ON DATABASE "dbname" TO "dbuser";
* ALTER DATABASE "dbname" OWNER TO "dbuser";
* REVOKE CONNECT ON DATABASE "dbname" FROM public;

==== Database connection ====
There are different possibilities to specify the host. You can use a DNS-Name, IPv4 or IPv6. A port can be optionally added with a colon.

Our PostgreSQL implementation sets sslmode=prefer, so SSL is used by default if enabled on the server.

==== Backup/Restore ====
External databases are still backuped as normal, but you can't restore such a database with the App Platform Manager on the external host! You must restore such a dump manually on your database host.

==== Database redundancy ====
In principle, it is possible to create redundancies for failure scenarios through this function.

However, there are different scenarios that need to be evaluated on a case-by-case basis:

* One database, multiple App Platforms (primary online / secondary '''offline''') where multiple apps access the same database.
** This mode of operation is legal as long as you can really ensure that only one App Platform is active at a time.

* One database, multiple App Platforms (primary online / secondary '''online''') with multiple apps accessing the same database.
** This operating mode cannot be used for innovaphone apps, as the app itself would have to be developed for such a mode, which it is not.

However, we advise great caution here! The use of the same databases from different nodes may only be used if you can ensure that the databases or runtime environments of apps cannot get into a ''split-brain'' mode.

== Relationship between app instances and app objects in the PBX ==
Typically an app instance is connected to one or more app objects in a customer PBX. This is done by configuring the same parameters on both sides:
* URL
* Password
The password is used by the PBX for authenticating itself, users and services against the app instance.

Some apps need a websocket connection with the PBX. When "websocket" is activated at the app object, the PBX establishes a websocket connection to the app instance and provides the APIs that are configured at the app object.

=== Supported scenarios ===
It is important to understand that the concept does not do any assumptions on how PBXes and APs are correlated. So you can have
* One App Platform for one customer
* One App Platform for many customers
* Many App Platforms for one customer
* Many App Platforms for many customers

Attention: The V13 installer can only configure the scenario "''One App Platform for one customer''". If you want to have a different scenario, you have to configure it manually.

For hosting or cloud scenarios you need special scenarios. Please refer our [[Howto:V13 Hosting| V13 Hosting]] instructions.

=== Restrictions ===
Currently we don't have redundancy for app instances or App Platforms.

== Update of the App Platform itself ==
The App Platform is build on top of buildroot and will receive updates and fixes from time to time. 
You can update the used build inside the Manager App by using the '''Update''' button at the top. 

It is strongly advised to make a full backup (VM) or at least backup all apps (Gateway) before you run such an update!

After the update has been downloaded and verified, your App Platform will reboot.
You can check the installation process after the reboot with the following URL: https://IP-of-AP/manager/ramdisk.log

== App services and multi-threading ==
Each App Service runs in a single process with no multi-threading, independent of the instances of the App Service. However, each instance maintains its own database connection and the database responds to this connect with the creation of a new process. Each app service therefore uses 1+''n'' threads (where ''n'' is the number of instances). All communication between app service instances and their clients must pass the single-threaded web server. On platforms with multi-threading support (i.e. VMware or Hyper-V), up to 1 + ''m'' + ''m'' * ''n'' (with ''m'' being the number of Apps and ''n'' the number of instances per App) threads can be utilized.

= AP Manager settings =

== General ==
* ''Enable Developer mode'': in developer mode, apps can be manually uploaded without an App Store
* ''Disable App security'': each App has an own unix user and if this flag is set, the user can login with SSH for debugging
* ''App Store URL'': the URL to the App Store where Apps are searched and also an update of the AP image itself
* ''Devices app URL'': the URL to the Devices App to manage the AP through Devices
* ''Devices app URL 2'': don't use!
* ''App Platform DNS name'': currently not used
* ''NTP server 1/2'': NTP servers for this AP (in addition to NTP servers retrieved by DHCP)
* ''Timezone string'': A timezone string which is used by the App Platform Manager to do certain jobs according to the configured timezone.
** Note that this doesn't change the timezone of the linux itself!
* ''DNS server 1/2'': DNS servers for this AP (in addition to DNS servers retrieved by DHCP)
* ''Database optimization time'': The database optimization process will be started at this hour (local time), with a random offset of up to 7 hours
* ''Command file'': see [[#Backup of the Apps| Backup of Apps]]

== Security ==
* ''Current Webserver certificates'': shows the current certificates with the ability to download them.
* ''Webserver certificate'': upload a webserver certificate in PEM format
* ''TLS profile'':
{{TLS_profiles}}
* ''Allow just HTTPs connections'': disable the HTTP port of the webserver and just allows HTTPs connections
* ''AP Manager password'': the password to the web interface of the AP Manager (normally set through Devices)
* ''Linux root user'': password of the root user (normally set through Devices)
* ''Linux admin user'': password of the admin user (normally set through Devices)

== Let's Encrypt ==

Configure the certificate creation by Let's Encrypt here.

* ''Enable'': turns the automatic creation on or off
* ''Let's Encrypt App URL'': the URL of your Connector for Let's Encrypt App Service. You can copy&paste this URL from your Connector for Let's Encrypt PBX Manager Plugin
* ''Let's Encrypt App Password'': the client password of your Connector for Let's Encrypt App Service. You can copy&paste this password from your Connector for Let's Encrypt PBX Manager Plugin
* ''Key length'': 2048, 3072 or 4096 (keep in mind, that [[{{NAMESPACE}}:Certificate_management#Certificate_Key_Length_and_CPU_Usage|a higher value provides higher security but also lower performance!]])
* ''DNS Name'': the external DNS names of your device (up to 100 possible)

== Alarms and events ==
* ''URL'': URL to the Events app
* ''Username/Password'': HTTP credentials of the Events app
* ''Email address'': an email address which will get emails on full disk alarms/warnings
* ''Threshold'': All Apps will be stopped and an hourly email sent on reaching this threshold. An alarm is generated 10% before reaching this threshold and an email is sent every 24 hours.

== SMTP ==
SMTP server settings for sending emails from within the AP Manager.

Starting with 16r1 you also can configure OAuth2 Authentications. You can have a look into our HowTo Article for assistance: [[Howto16r1:Configure OAuth2 E-Mail]]

== Replication ==
App Platform [[#App Platform replication|replication settings]]

== Registered Access Domains ==

== Update ==
Updates the App Platform to the latest image available on the App Store.

== Restart ==
Restarts the App Platform.

== Shutdown ==
Shuts down the App Platform.

= App Platform replication =

== Requirements ==

* 13r3 or above on both standby servers and the primary server
* at least an App Platform image starting with version 110002 (otherwise postgresql is too old)
* standby and primary servers must have the same system architecture
** arm gateways (IPx11) just with arm gateways (IPx11)
** arm64 gateways (IPx13) just with arm64 gateways (IPx13)
** x86_64 virtual machines just with x86_64 virtual machines
* the disk size on standby servers must be at least equal as the disk size on the primary server

== General ==
The configuration is done within the App Platform Manager next to the settings button under "Replication".

=== Off ===
No replication is done at all.

=== Primary ===
The App Platform acts as primary server for one or multiple standby servers. 
Max 8 standby servers can be configured. 
 
Every standby server must get a unique name on the primary server which is then also configured on the standby server itself. This is due to the fact, that the primary server preserves data for every standby server while it's not reachable. 
A standby server name must be a valid domain name, although this name is currently not used as DNS name (but might be used in the future). 
 
The password is randomly pregenerated and must be used as handed by the App Platform Manager.

==== PostgreSQL port ====
The default PostgreSQL port is 5432 and can't be changed on the primary. It must be reachable through your firewall or at least forwarded on a different port towards this App Platform on port 5432.

=== Standby ===
Configure the password from the primary and one of the not yet used standby server names. 
The host and port must be reachable through the network. You can specify a non default port which then must be forwarded somewhere else to port 5432 on your primary.

*Note: Do '''not''' configure the same standby name on different standby servers, as this will break the replication on at least one standby! 
*Note: On a standby, all '''locally installed apps are removed''' during installation

== Failure detection ==

The replication state on both primary and standby servers are continuously monitored. 
In case of a broken connection, an alarm is triggered at once and just cleared if the failure goes away. 
 
If such an alarm lasts for 5 minutes an email is send. The recipient address must be configured in the App Platform Manager settings under "Alarms and Events" and you must also provide a valid SMTP configuration.

== Failover ==

There is no automatic failover procedure. If you detect the failure state, you must get active yourself.

=== Standby down ===

Fix the standby server and see if the replication comes up again. If not, setup a new standby server which will replicate the whole database cluster from scratch.

=== Primary down ===

If the primary is down and cannot be brought into life again, you must take the following steps, depending on your configuration:

==== One standby server ====

* Disable the replication in the replication configuration. You will then have a standalone App Platform afterwards.

==== Multiple standby servers ====

* Change the replication type on one of the standby servers from standby to primary. Please note that the other standby entries must still exist here (they are automatically offered)!
* Change the host entry on the other standby servers to the new standby server. The standby server will sync the whole database cluster again, which will take time.

==== Configuration changes ====

You must also tell the PBXes and other tools to use the new primary server.

* You may simply change the IP address behind the DNS of your primary server to point to the new primary server.
**Note: to ensure rapid recognition of the new DNS target, the definition of an appropriate TTL value is recommended
* Without DNS, you must currently modify the configuration by replacing the IP address of the old primary with the new address.
** This must be done in every master PBX configuration.
** This must be done in every App configuration which may use this IP address, e.g. Devices which rolls out an alarm server configuration

== App Platfom update ==

If you're running an active standby server and the major version of the PostgreSQL database didn't change, you can simply update primary and standby servers independently. 
 
If it contains a ''new major version'' of the PostgreSQL database, you must follow these steps:

* deactivate replication on all standby servers (which promotes these standby servers to active servers)
* ensure that the '''same''' App Platform Manager version is running on primary and standby servers!
* perform the App Platform update on the primary server
* perform the App Platform update on the standby servers
* reactivate replication on the standby servers (which will do a full replication again, so it might take some time)

Alternativly you may setup the standby server from scratch directly with the new App Platform image version.

Sadly there is currently no better method offered by PostgreSQL to perform such an upgrade.

See also https://wiki.innovaphone.com/index.php?title=Howto14r2:Firmware_Upgrade_V14r1_V14r2#App_Platform_and_Apps

== Technical backgrounds ==

=== Streaming replication ===

We use the asynchronous [https://www.postgresql.org/docs/9.3/warm-standby.html#STREAMING-REPLICATION streaming replication of PostgreSQL]. A transaction thus just waits for a commit on the primary server. Standby servers will receive the transaction asynchronously afterwards to avoid a reduced writing performance. 
A primary server keeps the neccessary WAL files for every standby server until the standby fetched the neccessary information. 
This fact can lead to higher disk space usage on the primary if one or multiple standby servers are offline for a while.

Take care to fix broken replications as soon as possible to avoid a full disk on the primary server!

=== What is replicated ===
The whole database cluster of an app platform is replicated. This includes every database of every instance and the database of the App Platform Manager itself. 

=== App Services on standbys ===
The database of the App Platform Manager itself also contains the App service binaries to be able to restore applications in a failover case. 
You do not have to install App services on the standby if you install them on the primary. 
App Platform Manager and Webserver can be updated as usual through the App Store or the Devices App if the standby is connected to Devices.

=== App Platform Manager configuration of the standby server ===
The App Platform Manager configuration of the standby server cannot be stored inside the database, as the database is readonly. So it is stored inside a configuration JSON file under ''/home/root/standby.conf''. 
This configuration is backed up as usual by a Devices backup job and can be also manually restored on a standby (not on a primary though!).

Configuration options from the primary are not synced to the standby server, as the standby server has its own configuration (as it could be in a different network etc.)!

=== No automatic failover ===

There is currently no automatic failover mechanism. PostgreSQL doesn't offer multi master replication, so writing is just possible on the primary itself. Standby servers have a readonly database. 
Let's consider the following use case if we would implement an automatic failover with the current technical possibilities: 
* The primary server is connected to a master PBX.
* A slave PBX is also connected to the primary server in another location.
* A standby server is in this location and replicates from the primary.
* The internet connection between primary and standby fails.
* The standby promotes itself to primary, so that the master PBX now writes to the old primary and the slave PBX now writes to the "new" primary.
* The internet connection comes up again and both primary and standby servers now have databases which are out of sync and which cannot be merged.

=== Security ===

* port 5432 must be reachable on the App Platform
* For every standby a PostgreSQL user is created with the REPLICATION role on the primary. Just this user has access to the database server from non localhost connections.
* You cannot establish a standard connection with such a user and modify/read from tables.
* The replication connection is established over TLS by default.

= App Installer PBX Manager Plugin =
== Requirements ==

* V14 and above

== General ==

The app installer plugin allows IT administrator (with access to the PBX Manager) to install/update/delete new apps from the innovaphone app store including Partners apps. It is automatically available with existing app platforms or after adding a new one in the PBX Manager.
It offers a view to the App Platform Manager‘s App Store with all the available functionalities and simplifies the install, update and uninstall of apps.

== Dedicated AP for each user ==

Installing a new app will install the app service and add a new instance with the user’s domain. The instance is automatically started. 
This further enables the configuration of the instance through its respective PBX Manager plugin. 
Uninstalling the app will remove the app service and the corresponding instance.

== Shared AP between users ==

Installing a new app works in a similar way to that of the dedicated AP. However, each time a new user installs the app, only a new instance is created if the app service is already installed. 
A user can uninstall the app, in this case the corresponding instance is deleted. If no more instances exist, then the app service is uninstalled. 
The administrator can only update the app service in such scenario.

= Known Issues =

== Reboot after an image update hangs (ARM/ARM64 gateway) ==

If it happens, that the App Platform doesn't recover after the reboot, please open the Admin UI of the corresponding gateway and take a look at App Platform -> General. 
If '''Kernel command line''' is set to '''/dev/ram0''', the App Platform booted the ramdisk. 
 
Try to fetch the upgrade log file:
https://[APP-PLATFROM-IP/DNS]/manager/ramdisk.log
 
If this doesn't work, try to login with putty in this case (default credentials admin/ipapps and root/iplinux) and issue this command: 
''cat /apps/install_step1.log'' 
 
If this file contains '''finished''' at the end, you can reconfigure the settings under App Platform -> General: 
* press '''Stop'''
* Initrd file: empty
* Kernel command line:
** IPxx11: '''root=/dev/sda3'''
** IPxx13: '''root=/dev/nvme0n1p3'''
* Ramdisk size: empty
* press '''Start'''

The App Platform should boot and run the already updated image.

<pre style="color: red; font-size:150%;">---WARNING---
If the file doesn't contain "finished" at the end, you may still need to wait, as an upgrade may take some time!
Do not reconfigure without being sure that the upgrade has finished, otherwise your system may won't run!</pre>

== Reboot after an image update boots always into rescue mode (virtual machine) ==

This most likely means that the image installation didn't finish the first time and was interrupted before the bootloader settings could be changed back to the default partition. 
 
If your App Platform doesn't boot or isn't normally accessible after manual selection of the standard entry in the boot menu, you need to '''revert''' to a '''snapshot/backup''' prior to the update. 
If your App Platform runs normally though, you can follow this instruction to change the default boot entry: 
 
* boot into the '''rescue''' partition
* login with root/iplinux
* edit the file /boot/grub/grub.cfg
** search the line with '''set default=0''' and change it to '''set default=1'''
** reboot

== App Platform doesn't start after an update ==

=== Gateway ===
If it happens, that the App Platform doesn't want to start an update, please open the Admin UI of the corresponding gateway and take a look at App Platform -> General. 
* '''Shutdown''' the App Platform and '''Stop''' it 
* Set '''Kernel command line''' to '''/dev/ram0''' 
* Set '''Initrd file''' to '''ramdisk.ext2.xz''' 
* Set '''Ramdisk size''' to '''100000''' 
* '''Start''' the App Platform now. 

The App Platform now either applies the image update or it reboots into the old image. Try the image update afterwards again.

Note: This process can take a while, after it's finished it reboots and automatically change the '''Kernel command line''' value.

=== Virtual Machine ===

Boot into the '''rescue''' partition.

The App Platform now either applies the image update or it reboots into the old image. Try the image update afterwards again.

=== It still doesn't start ===

If it still doesn't start, configure the App Platform to boot from /dev/sda3|IPx11 or /dev/nvme0n1p3|IPx13 (or inside a VM start the second boot loader entry) and login with SSH as root.
Then do a first check to verify that you have a specific error due to an incomplete update or a [[Howto15r1:Firmware Upgrade V14r2 V15r1#AP Upgrade to Image 130006|wrong update order]]:

* /etc/init.d/S92manager stop
* /apps/manager/manager
* if this outputs '''error while loading shared libraries: libcrypto.so.3:''' you have a manager version which cannot run on the current image.

In this case you must download an older build (14r1 1410593):

* /etc/init.d/S92manager stop
* wget --no-check-certificate -O /apps/manager/manager https://webbuild.innovaphone.com/1410593/arm/manager/manager
** inside a virtual machine, use '''x86_64''' inside the path instead of '''arm'''
** on an IP6013, use '''arm64''' inside the path instead of '''arm'''
* wget --no-check-certificate -O /apps/webserver/webserver https://webbuild.innovaphone.com/1410593/arm/webserver/webserver
** inside a virtual machine, use '''x86_64''' inside the path instead of '''arm'''
** on an IP6013, use '''arm64''' inside the path instead of '''arm'''
* chown root:root /apps/manager/manager
* chown root:root /apps/webserver/webserver
* chmod +x /apps/manager/manager
* chmod +x /apps/webserver/webserver
* echo 110000 > /mnt/sda1/label
** this allows the manager to perform an image update again
* /etc/init.d/S92manager start
* now perform an image update and '''afterwards''' update your apps again

== Webserver doesn't respond after an image update ==

If you can't reach the web UI after an image update, please try to connect with SSH as admin user and delete old coredumps, which may prevent the App Platform Manager from starting correctly:
* su root (become root)
* rm -f /mnt/sda2/log/core_dumps/*/*
* /etc/init.d/S92manager restart

Check if you can now reach the App Platform again.

= Tracing =
Each App Service has its own log file, which can be accessed through the Manager App. You can configure a log file size for each App Service. 
Each App Intance has its own trace flags. The following trace flags can be set: 

* Alarm client: used by the manager to send alarms to an alarm server
* App: logs from the App Service itself
* App WebSocket: logs app websocket connections (e.g. from PBX objects to an App Service or from the UI to the App Service)
* AppSharing: just native clients
* AppProxy: just native clients, logs requests which are proxied between the local webserver and the remote server
* Audio: just native clients
* Browser: just native clients
* Command: the command interface is used to execute shell commands, e.g. used by the manager App
* Config: logs config changes of an App
* Database: database logs
* DB files: database file logs
* DNS: DNS request logging
* DTLS: just native clients, DTLS request logging
* Ethernet: interface to get ethernet adapater infos, just manager App
* File: logs for file system access (synchronous), e.g. manager App
* Files: logs for file system access (asynchronous)
* HTTP client: http client logs
* HTTP file: logs for static HTTP files
* ICE: just native clients
* LDS: local domain sockets
* Media: just native clients
* Media channel: just native clients
* Process: IProcess interface logs which is used for spawning, killing processes etc.
* SMTP: SMTP client logs
* TCP: TCP logs
* Time: ITime interface logs
* TLS: TLS logs
* TURN: just native clients
* UDP: UDP logs
* Video: just native clients
* WebSocket client: logs outgoing websocket connections
* Webserver traffic: logs incoming HTTP traffic, which is forwarded from the webserver to the App
* WebDAV service: logs WebDAV requests to the App
* Webserver: enables webserver specific logs

== RPCAP ==

If you open the Manager App, click on the Manager in the left list and then on the Diagnostics button, you can enable RPCAP. 
You can add the interface in wireshark with the string:
rpcap://<APP-Platform-IP>/eth0

'''Please don't forget to disable RPCAP after your testing!'''

== Exclamation marks ==
If you see an exclamation mark next to an App Service, this App Service has been crashed before. 
You can download a core dump or backtraces for further investigation. To clear the exclamation mark, you have to delete the log files.

= How-Tos =

== How to retrieve files from the App Platform ==
To retrieve files from the App Platform which can not be retrieved via the App Platform manager UI, you can connect to the App Platform using the SCP protocol on port 22. 
 
First copy files to /home/admin as root with Putty or another SSH client:
* use the ''DNS'' name or IP address of your App Platform (not the PBX)
* use user ''admin'' and the appropriate password (''ipapps'' by default)
* use ''su root'' to be root (''iplinux'' as default password)
 
You can now copy files to ''/home/admin'' (e.g. from /var/log/apps/manager/...). 
 
You can create a tar archive with all logs like this:
* cd /home/admin
* tar -cf - /var/log/* | xz -z - > log.tar.xz
** you may want to exclude coredumps (due to their size):
** tar -cf - --exclude=/var/log/core_dumps/* /var/log/* | xz -z - > log.tar.xz
* chown admin:admin /home/admin/log.tar.xz
 
Then copy the files to your local system, e.g. with WinSCP 
* use ''SCP'' as protocol (NB: WebDAV is not supported on most of the directories on the App Platform )
* use the ''DNS'' name or IP address of your App Platform (not the PBX)
* use user ''admin'' and the appropriate password (''ipapps'' by default)
* use ''/home/admin'' as start directory
* copy the needed files

== App Platform disk space warning ==

If the configured threshold is reached, all Apps are stopped inside the App Platform . You must then free disk space somehow.

=== Find large instances ===
Click through your apps in the tree on the left side and take a look at the database size of each instance.

=== Delete data inside an instance ===
It depends on the type of app if you can delete data or not. E.g. you can start the Files app and delete files inside this app. 
This won't reclaim disk space though due to the way how PostgreSQL databases work, so you need to follow this guide to reclaim the disk space:

* start the corresponding App
* delete data inside the App
* optimize disk usage of the database by cliking on the button "Clean up database" under Edit instance. If this does not help, continue with the following steps.
* stop the corresponding App again
* download a backup of the instance (backup button at the top), this backup contains the whole instance data, also the password of the instance
* delete this specific instance
* restore the downloaded backup (restore button at the top)

Depending on the hardware and the size of the instance, this process may take hours to complete!

=== Resize the disk ===
The resizing of a disk is just possible for virtual machines, see [[#Resizing the disk of a Virtual machine|Resizing the disk of a Virtual machine]].

=== Delete the whole instance ===
If there is no other possibility, you can delete the whole instance. Afterwards you recreate the instance with the same values and a new random password. Don't forget to set this password in the corresponding PBX App objects though!

=== Restart the Apps or the App Platform ===
If you have enough disk space again, you must either restart the whole App Platform or you manually start all Apps again.

== App Platform/Apps app not online anymore due to full disk ==
If the apps app is not online anymore and you can't access any apps anymore, try to login with an SSH client to see if your disk is full.
Login as admin and afterwards as root (su root). 
 
* issue '''df -h''' and see the disk usage of /dev/sda2, if this is 100%, your disk is too full
* stop the manager
** /etc/init.d/S92manager stop
* empty the 500 MB file, which is exactly for this case here (manager must be 13r1 SR9 or higher to have this file)
** echo "" > /mnt/sda2/empty_if_no_space
* delete log files to recover some space
** rm /var/log/apps/*/*
** rm /var/log/core_dumps/*/*
* restart the postgresql server (see the output if this worked or not)
** /etc/init.d/S50postgresql restart
* restart the manager
** /etc/init.d/S92manager restart
* wait until everything is online again
* open the Apps app and try to find the instance which uses the most disk space and try to delete files/content from it
** you may want to stop all app services first to prevent more writes to the database
** if not possible, you can delete this instance, but you'll loose all data from this instance then!
* after that you can try [[{{NAMESPACE}}:Concept_App_Platform#Shrink_the_physically_size_of_PostgreSQL_database_files|Reference14r2:Concept_App_Platform#Shrink_the_physically_size_of_PostgreSQL_database_files]] to free up space
** If this does not work you can create a backup from the database, delete the database and import the database again.
* free up at least 500 MB so that the manager can create the file again
* delete /mnt/sda2/empty_if_no_space if you are done and restart the manager:
** rm /mnt/sda2/empty_if_no_space
** /etc/init.d/S92manager restart
** the manager restart automatically recreates the empty_if_no_space file if this file doesn't exist

Make sure, that you do '''not''' have backups configured to a local files instance while this files instance is not excluded from backups.
An instance can be excluded from backups in the instance settings in the App Platform Manager.

If all of this doesn't help, you can resize the file system on a VM:
* proceed with [[{{NAMESPACE}}:Concept_App_Platform#Resizing_the_disk_of_a_Virtual_machine|Reference14r2:Concept_App_Platform#Resizing_the_disk_of_a_Virtual_machine]]

== Resizing the disk of a Virtual machine ==

Do '''NOT''' resize if you're running an App Platform version higher than '''110000''' and lower than '''110027''' or '''130007''' and lower than '''130015''' or your data will be lost!
Please update your App Platform to version 130015 or higher before you start resizing your disk.

* stop the VM
* expand the disk using your VM utilities
* start the VM, select in the blue screen the option '''rescue/setup''' (just the first 3 seconds to see)
* login with '''root''' and '''iplinux'''
* execute this command: '''/home/root/install_step1.sh log.txt resize'''
* the VM reboots automatically after a successful resize

== Shrink the physically size of PostgreSQL database files ==
Tuples that are deleted in your database are not physically removed from the database-file. So the claimed space on the harddisk is still in use after the delete operation.
If you need to free up some disk space you can force to reorganize the physically database-file on your harddisk.

You can also start this process through the instance settings as long as the App Platform Manager is still running.

'''Important: You are operating on the Database, you have to make a Backup of your Database before you do this!'''

Login via SSH to the APPlatform with the ''admin'' User
su root

=== All databases ===
/etc/init.d/S92manager stop # not always needed, but in case of database errors recommended, of course no app is online then
sudo -u postgres reindexdb -a
sudo -u postgres vacuumdb -a -f
/etc/init.d/S92manager restart # just execute if the manager has been stopped above

=== single database ===
sudo -u postgres reindexdb -d dbname # for a single database with dbname
sudo -u postgres vacuumdb -d dbname -f # for a single database with dbname

Note: This may take some time and the App database is not available during this time

After the process you can check the free dispace via <code>df -h</code>. You can check the claimed space from the database file with the command <code>du -sh /mnt/sda2/pgsql/</code>.

== Change IP Addresses / DNS Names / System Name ==

If you want to change the System Name or the DNS Name of the PBX and/or App Platform Platform you must change records manually '''in the described order'''!
You have to know the Admin password to directly Login to the App Platform .

=== App Platform ===
; Settings - General
* ''Devices app URL''
* ''App platform DNS name''

; Settings - Alarms and Events
* ''URL''

; All Instances
* ''Domain''
* ''Webserver path''

=== PBX ===
Download the configuration and ''search/replace'' in the config file. Upload the config file and reboot.

Manual:
* ''URL'' in all PBX Object (Apps, Voicemail ...)
* [[{{NAMESPACE}}:Gateway/CDR|CDRx]]
* [[{{NAMESPACE}}:PBX/Config/General|IP address for App Platform]]
* [[{{NAMESPACE}}:PBX/Config/myApps|Reset Password Page]]
* [[{{NAMESPACE}}:PBX/Config/Authentication|Verification link]]

Depending on your change you have to activate/deactivate the Setting [[{{NAMESPACE}}:PBX/Config/General|Operation without DNS]]

=== Additional Devices / Steps ===
* ''Devices Registration URL''
** There is no automatism to change the URL on all devices in your setup.
** If you have the option to use DHCP, you can temporarily overwrite the [[{{NAMESPACE}}:Services/Update|Update URL]] and execute a [[{{NAMESPACE}}:Concept_Update_Server|custom update script]] to change the ''Device Registration URL''
* ''Alarm server''
* Reverse Proxy configuration
* Change ''Domain Name'' in Devices if you have also changed the system name

== How to recover from a broken File System ==
Sometimes you may find messages in the ''messages'' log file (in ''var/log'') like

initial error at 1500329378: ext4_journal_start_sb:328
last error at 1500329378: ext4_journal_start_sb:328

Or you get events like "Broken file system" from your App Platform .

This indicates a file system failure on the Linux Installation.

When the Linux file system is broken, you can try to repair it using some command line Linux tools.

If this doesn't fix your issue, you need to replace the SSD with a new one, re-install the App Platform and any applications and restore your backups.

=== Gateway ===

* Open the WebGUI of the gateway running your LAP and proceed to ''App Platform/General''
** terminate Linux (''Status/Stop'')
** modify the Kernel command line from root=/dev/sda3 (or /dev/nvme0n1p3) to root=/dev/ram0
** modify the Initrd file to ramdisk.ext2.xz
** modify the ramdisk size to 100000
** start Linux again
:: This will run Linux on another (hopefully sane) partition.

* use [https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html putty] to log in to the LAP's command line ( try either user: root, pw: iplinux '''OR''' user: admin, pw: ipapps)
** use this to be root <code>su - root</code> (password iplinux)
** on the command prompt, use <code>e2fsck -p -f /dev/sda2</code> on IPx10/IPx11 gateways
** on the command prompt, use <code>e2fsck -p -f /dev/sda3</code> on IPx10/IPx11 gateways
** on the command prompt, use <code>e2fsck -p -f /dev/nvme0n1p2</code> on IPx13 gateways
** on the command prompt, use <code>e2fsck -p -f /dev/nvme0n1p3</code> on IPx13 gateways
:: this should fix any issue on the file system

* go back to the WebGUI of the gateway running your LAP and proceed to ''App Platform/General''
** terminate Linux (''Status/Stop'')
** modify the ''Kernel command line'' from ''root=/dev/ram0'' to <code>root=/dev/sda3</code> (IPx10/IPx11) or to <code>root=/dev/nvme0n1p3</code> (IPx13)
** clear the Initrd file field
** clear the ramdisk size field
** start Linux again
:: This will run Linux on the original partition.

=== VM ===

Restart the VM and select the first entry in the boot menu from grub.

* use [https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html putty] to log in to the LAP's command line ( try either user: root, pw: iplinux '''OR''' user: admin, pw: ipapps)
** use this to be root <code>su - root</code> (password iplinux)
** on the command prompt, use <code>e2fsck -p -f /dev/sda2</code>
** on the command prompt, use <code>e2fsck -p -f /dev/sda3</code>
:: this should fix any issue on the file system
* Reboot your VM
[[Category:Concept]]

== How to create a memory dump of a running process ==

Sometimes it's usefull to have a memory dump of a running process to investigate certain issues.

* login with SSH and become root
* find out the PID of the relevant process, e.g. with ''ps aux | grep /apps/manager/manager | grep -v grep''
* gdb --pid PID -ex gcore --batch
* this creates a core file core.PID
* download this core file with WinSCP or similar tools

== Move instance database to external database host ==

In case you want to use an external database server instead of the integrated:

* download a backup of the specific instance over the App Platform Manager
* create a postgresql database on the external host:
** createdb --encoding=UTF-8 exampledb
* restore the backup
** pg_restore -d exampledb backup-exampledb.dump
* change the ownership to a specific postgresql user (which you have to create yourself first)
** psql -d postgres -c "ALTER DATABASE exampledb OWNER TO exampleuser"
* configure the database host, name, user and password on the instance inside the App Platform Manager

Howto:Security works with innovaphone

2026-08-10T13:10:38Z

Vsc: /* TLS */

==Applies To==

* all innovaphone devices

==More Information==
Security issues in VoIP installations become more and more important to customers. While innovaphone very early has implemented a security framework based on the H.235 standard for H.323 supporting authentication and message integrity, the need for encryption to enforce privacy more and more emerges as a requirement.

This paper discusses the existing mechanisms in the version 6,7,8 and 9 release.

==Risks==

Voice over IP applications are like all other data applications exposed to a number of security threats.

These threats can be categorized as follows

• Availability

• Privacy

• Integrity

• Authenticity

• Accountability

===Availability===
As all devices attached to a network, VoIP devices may be subject to attacks against the availability of their offered services.

Such so-called Denial of Service Attacks may be attempted using various strategies, including amongst others exploiting weaknesses of the implementation or legal but excessive use of offered resources.

===Privacy===
As with all communication systems, VoIP devices may be misused to disclose confidential information. With telephone systems, this obviously involves unauthorized access to voice conversations. Moreover, access to configuration data (such as registration accounts, passwords, and extension numbers) can be of interest to attackers as well as call data (such as time and source/destination of calls). Call fraud or so called [[Howto:Protection against Brute Force Attacks | brute force attacks]] are very common these days.

===Integrity===
The integrity of call signalling data as well as of the voice communication itself can be of utmost importance. Spoofing of calling party ids for example may be used to obtain unaccounted access to particular resources (such as long distance calls or special services). But also more subtle and non-obvious tampering with call signalling data like faking cause codes (signalling busy when the party in fact does not respond) etc. or silently changing a call destination may cause severe harm.

==Security Features implemented in Version 6==

innovaphone products today feature a number of security features.

This article provides a rundown of the essential features and how they are enabled.

===Securing Configuration Data===
All configurations for innovaphone devices are stored in local flash memory.

While access to the data through normal interfaces is password protected, the content can potentially be examined if an attacker has physical access to the device (this would require disassembly of the device and examination of the flash EPROM).

Whenever you pass a configured device to someone else (e.g. when selling it), you should keep this in mind. If this is a concern, erase the data before (see related articles below). Configuration data can be dumped to text format using the “Config show” command.

From version 5 on, the resulting text file does not contain any clear-text passwords. Still, remaining configuration information may be considered sensitive. So be careful when providing this information to 3rd parties.

Because passwords are encrypted in the config file, you will need to remember the admin password of the device being dumped in order to load it to another device later on.

===Securing Access to Configuration Data===
innovaphone devices are configured through a web based interface using HTTP or HTTPS access.

===HTTP===
For HTTP authentication, both basic authentication (which is not encrypted) as well as digest authentication is available. You should make sure the browser you are using supports digest authentication which allows for reasonable security against password snooping and man-in-the-middle attacks. There is an option to enforce digest authentication in the “General Settings” (in other words, to disable basic authentication).

However, since the PBX’s SOAP interface is based on HTTP too, all SOAP clients not supporting digest authentication (and the TAPI driver currently is such a client) would be disabled using this option.

innovaphone devices feature non-protected access to the devices home page.

This is convenient; however, it may reveal some critical information to random port scanners targeting a device from the Internet. You may thus choose to password protect even the home page using an option in the “General Settings” area.

By default, all HTTP clients can gain access to the device configuration provided they have the right password. However, there is an option to restrict HTTP access generally to a particular host or network. This option allows you to restrict all HTTP access (and thus administrative access too) e.g. to hosts from within your own LAN.

If remote configuration access is required though (which would be disabled by this setting), you may consider to setup an administrative PPTP (or PPP over ISDN) dial-in access to the device. Many innovaphone devices do support such kind of dial-in out of the box. You would then use the “assign remote IP address” option and assign a local ip address to the dial-in client. This way, remote configuration is still possible and additionally secured by the PPTP encryption layer.

Due to the computational overhead of HTTPS, HTTP payload traffic is not encrypted in innovaphone devices. If payload encryption is critical to you for administration access, make sure you configure an encrypted PPTP dial-in access for configuration as described above.

There is a legacy, telnet based access to the configuration layer. Telnet is inherently unsafe since it transfers unencrypted passwords. It is not recommended to use this. From build 04-5807 on, telnet access is disabled by default. Previous builds can disable telnet access by specifying “/port 0” on the TELNET0 config file line.

===HTTPS===
HTTPS is supported in the since Version 6 Service Release 2 (V6 SR2). RFC 2818 defines use of TLS (Transport Level Security, RFC 2246) to secure the HTTP protocol.

===Managing Accounts===
All administrative functions are secured by account names and passwords. It is strongly recommended neither to keep the default account nor the default password setting.

===Access to VoIP resources===
Access to VoIP resources (such as gatekeeper registrations and access to trunk lines) can be secured by account and password. If securing VoIP resources is an issue, make sure that all gatekeeper accounts are secured by a password. You may even want to consider disallowing any registration without password, even from within the local area network. This can be done in the “general settings” area of the PBX.

To protect your trunk lines from unintended access, make sure to configure all gateways (GWxx entries) properly. For gatekeeper type entries, make sure there is a password, for gateway type entries, make sure the configured netmask suits your needs. Double check all routing entries to avoid unintended access e.g. to trunk lines.

===PPP and PPTP===
When using built-in dial-in (PPP, PPTP) interfaces, PAP, CHAP, MS-CHAPv1 and Ms-CHAPv2 are supported. PAP by design does not allow for password encryption and is thus not recommended. The CHAP variations do support password encryption using MD4 and DES and are therefore reasonably secure.

There is no payload encryption available for PPP (that is, PPP over ISDN) and PPPoE (i.e. xDSL). However, using ISDN dialup, payload encryption is not really an issue.

PPTP however features powerful payload encryption in addition to password encryption. It is using SHA-1 for session key encryption and RC4 up to 128bit for payload encryption. If payload encryption is an issue to you, you should check the “enable encryption” flag in the PPTP configuration. Keep in mind that payload encryption incurs computational overhead and the number of concurrent PPTP session the device can handle is reduced. Using PPTP is an option if fully payload encrypted configuration access is a requirement (see above).

===RAS Registrations===
H323 user account passwords are obviously sensitive information. innovaphone devices feature RAS RegistrationRequest (RRQ) password encryption based on the H.235 standard (H.235v2 Annex D – Baseline Security Profile). By requiring knowledge of a shared secret on both ends, mutual authentication is provided by this mechanism.

===H.225 Signalling===
Based on the H.235 authentication (see above), H.225 signalling messages carry a signature which ensure message integrity in both directions. While message content may still be looked at and thus possibly sensitive information may be disclosed, this mechanism effectively disallows corruption of call, authentication and accounting data and renders man-in-the-middle attacks ineffective.

===RTP===
RTP (i.e. media stream) traffic is not encrypted with Version 6. However, media stream endpoints are negotiated securely (see above), so that content spoofing is made difficult.

===SIP message security===
The current SIP implementation features mutual digest authentication and a reasonable protection against spoofed identities, there is currently no message digest signature available in SIP messages. The integrity of SIP messages thus is not ensured as is the integrity of H.225 and RAS messages (see above).

===SOAP Client account===
SOAP clients (such as the TAPI driver or the Operator) require an account/password for authentication at the HTTP layer. Although the devices admin account can be used for that, it is better practice to use the PBX user password for this. For the HTTP credentials, you can use the PBX users “Name” as account and it’s “Password” as the password. You will use the “Long Name” as SOAP access user name.

When configuring the TAPI driver e.g., you would create a user with Long Name _TAPI_, Name tapi and a password. You would then use tapi/password as Gateway Platform Access/Account/Password and _TAPI_ as PBX Access/Username.

===SNMP===
SNMP is only for monitoring and does not allow any configuration changes. You may want to restrict the list of “accepted hosts” using the gateway applets SNMP area. You may want to change the “community” to a non-standard value.

===ISDN data calls===
ISDN data calls are accepted by innovaphone devices as voice calls are and they are routed similarly. Although innovaphone devices may be configured to terminate a data call and thus access the local network via dial-in, this option must be explicitly enabled.

===Denial of Service attacks===
Like any other network device, innovaphone devices may be a target for a denial of service attack. It is therefore recommended, to protect against malicious access using standard firewall techniques. However, innovaphone devices feature a built-in DoS filter which will discard unreasonable inbound traffic. Also, it is based on a dedicated and proprietary operating system which is usually not a target for viruses and other malicious code.

===Arp Spoofing===
Tools performing VoIP privacy attacks have been made publicly available in order to tap in to VoIP conversations in a local area network. These attacks are based on spoofing layer 2 networks addresses to create a man-in-the-middle scenario where a conversation can be recorded without service interruption to the original participants.

Basically, the attack is based on the fact that the mapping between IP addresses and Layer2 (MAC) addresses is usually built on-the-fly using a protocol (ARP) that has no security built in. Attackers can change this association without notice and thus redirect any traffic to themselves. These kind of attacks have been addressed in V6.

innovaphone ARP stacks will reject unexpected changes to the address mapping, and furthermore cease any traffic to the poisened mac address for 5 seconds. This feature needs to be enabled [[Reference7:Configuration/ETH/IP]] with ''Check ARP''.

This way, an Arp spoofing attempt will be seen as service interruption by the end users, giving the network administrator a chance to investigate.

===Availability===
innovaphone devices have proved to be very robust and reliable. However, if availability is of utmost importance, redundancy options are available which allow for outstanding protection against loss of service.

Also, all innovaphone devices may be powered via power over Ethernet (PoE) which when combined with an uninterrupted power supply (UPS) ensure seamless operation even in the case of a local power failure.

PoE may be used concurrently with a local power supply.

==Additional Security Features in Version 7==
Although at present there are a number of security features implemented in innovaphone VoIP devices, there is still a lack of protection for the privacy of communications. This reflects the fact that previously, the source of attacks usually was expected to be outside of the own organization.

Such risks have been defended using sophisticated firewalls and VPN appliances on the own network border which provide for encryption and thus privacy protection. However, today’s security risks are more and more expected to emerge from within the organization.

The inability of contemporary local area network equipment to provide for encryption and thus privacy of communications puts the burden on the application. VoIP application as well as other data applications must provide for end-to-end encryption.

The V7 introduces a number of features which help to defend against the risks of security attacks.

===SRTP===
Secure RTP is a security mechanism defined by RFC 3711. SRTP can be used for voice encryption with H.323 and SIP.
SRTP encrypts the RTP stream with AES. As a result the key will be chosen randomly on both sites and sent with the signaling data.

Only if both sites have activated encryption SRTP is used.

SRTP can not be forced.

innovaphone supports with Version 7:

*AES-128
*AES-192
*AES-256

all with 32 or 80 bit SHA1 hashed message authentication codes (HMAC).

====SRTP Interoperability====
No interop problems are to be expected if other vendor device offers exactly one of the above crypto suites. Innovaphone equiment will always adapt to the offered crypto suite.

Problems will araise if other vendor device offers multiple crypto suites during call establishment.
In this case all innovaphone devices must be configured to that crypto suite, which is offered at first position.

===TLS===
The TLS protocol obsoletes SSL and allows applications to communicate across a network in a way designed to prevent eavesdropping, tampering, and message forgery. TLS provides endpoint authentication and communications privacy over the Internet using cryptography.

Typically, only the server is authenticated (i.e., its identity is ensured) while the client remains unauthenticated; this means that the end user (whether an individual or an application, such as a Web browser) can be sure with whom they are communicating. The next level of security—in which both ends of the ''conversation'' are sure with whom they are communicating—is known as mutual authentication. Mutual authentication requires public key infrastructure (PKI) deployment to clients.

TLS is needed for
* HTTPS
* secure SIP (SIPS)

innovaphone supports TLS with the following methods:

* RSA with 3DES
* RSA with AES-128
* RSA with AES-256

all with SHA1 hashes.

===H.235===
We currently use H.235v2 Annex D – Baseline Security Profile. It relies on symmetric techniques and provides authentication and/or message integrity based on shared secrets. H.235v3 Annex G – SRTP & MIKEY usage discusses a key management scheme suitable for use of SRTP (RFC 3711).

As SRTP does not specify a key management scheme by itself, the MSEC working group within the IETF discusses key management solutions and currently favours MIKEY. MIKEY defines AES as mandatory transport encryption enforces the use of X.509v3 certificates for public key encryption and digital signatures.

innovaphone implemented H.235 key Exchange for SRTP in Version 7.

===SIPS===
SIPS is SIP over TLS, which is mandated for proxies, redirect servers and registrars by RFC 3261. However, use of TLS requires a secure transport protocol, i.e. TCP.

The mechanisms supported are: TLS, HTTP Digest.

SIPS is supported since version 7.

===Telnet===
The secure shell protocol as per RFC 4251 can be used to apply content encryption to telnet sessions. We will not implement secure shell as we do not recommended to use Telnet at all, and telnet access is disabled by default.

===LDAP===
LDAP uses the SASL security as per RFC 2222. Unfortunately, this does not account for content encryption. LDAP v3 thus has defined extension for use of TLS with LDAP (in RFC 2830).

With Version 9 innovaphone will support LDAP via TLS

===SNMP===
SNMP versions 1 and 2 have been considered “insecure”. SNMP Version 3 includes considerably enhanced security mechanisms (as per RFC 3414). Unfortunately, this puts some difficult burden on SNMP implementations resulting in a rather little deployment compared to SNMP V2. There will be no SNMP security implementation on innovaphone side, as it is read only on the devices.

===802.1X port security===
Port security secures physical ports by enforcing a user authentication before allowing data transfer through a given Ethernet switch port. The endpoint needs to perform this authentication in order to be able to communicate.

As VoIP telephones usually work as an Ethernet switch (featuring a second “PC port”) they would need to enforce port security on this second port too in order not to compromise the security setup. The switch implementation must support multiple authentications on one port.

innovaphone supports the 802.1x feature on all products.

===X.509 Certificates===
Cryptographic certificates assign a public key to an identity. This is needed for the authentication of communication endpoints. The X.509 standard defines one commonly used format for such certificates.

innovaphone supports management functionality for both trusted CA certificates and device certificates / private keys.

We use X.509v3.

==Additional Security Features in Version 8==

===Kerberos based Authentication ===

A single innovaphone device can act as an authentication server for all other innovaphone devices. User accounts that are managed on the authentication server can be used to login on each device in the installation. You can also configure devices to accept user accounts from a PBX (full admin rights) or a Windows domain.

===IP Filter===

Separate IP filter for log-ins with password and without password.

==Additional Security Features in Version 9==

===Object Device===

*In case of registrations to a PBX using incorrect passwords, all other registrations to the relevant object are blocked for 20secs ([[Reference9:PBX/Objects#Security_issues | ''Security issues'' in PBX/Objects]]).

*It is possible to define at the object (for each [[Reference9:PBX/Objects#Devices | device ]]) that the admin password is needed to log in.

*It is possible to delete all [[Reference9:PBX/Objects#Devices |devices ]] at an object and thus completely deny any registration.

===HTTP Access Filter ===

Support for multiple networks in IP filter for the HTTP server (administration).

=== Unknown registrations===

It is possible to use the admin password for unknown registrations (deployment of new endpoints).

=== Voicemail===

The innovaphone voicemail supports SRTP via H.323 or SIPS.

===LDAP via TLS===

With version 9 innovaphone supports LDAP via TLS, for LDAP replication between master/slave/standby/standby-slave PBX.

==Additional Security Features in Version 10==

===TLS===

From v10sr8 certificates with SHA2 signatures are accepted. The new supported signature algorithms are SHA256, SHA384 and SHA512 with RSA encryption.

=== SIP Blacklist ===
Introduced in v10sr9. The SIP stack maintains an automated blacklist. When a REGISTER message is received for either a non-existing user or for an existing user but with a wrong password, the messages source IP address is put on a blacklist for at least 20s. SIP messages received from IP addresses in the blacklist are ignored.

==Additional Security Features in Version 11==

===H.460.17===

Endpoints can now register using H323/TLS. Device certificates can be used for authenticating registrations.

===TLS===

From version 11 TLS protocol version 1.1 and renegotiation (RFC 5746) is supported.

Support for certificates with SHA2 signatures (SHA224, SHA256, SHA384, SHA512).

===DTLS-SRTP===

Up to version 10 SDES was used for the exchange of SRTP keys between endpoints. This means the SRTP key is transported hop-to-hop inside signalling.

From version 11 DTLS-SRTP (RFC 5764) is available as an additional key exchange method. DTLS-SRTP uses end-to-end encryption and is done inband in the media stream. This means that the PBXes and proxies that forward signalling messages can not see the SRTP key. As a drawback, DTLS-SRTP adds a delay at the begin of calls.

DTLS-SRTP supports negotiation of the following SRTP cipher suites:
* AES-128 with 32-bit SHA1 HMAC
* AES-128 with 80-bit SHA1 HMAC

See also: [[Reference13r3:Concept_DTLS-SRTP]]

===Session border controller - SBC===
The Session Border Controller provides the session border functionality, which is that a device can register to an session border object and the session border object establishes the registration to a configured PBX. This can be used when for example the device is located within the public internet and the PBX in a private network.

===Disable NetBIOS===
You can disable the NetBIOS NameServer Feature in the [[Reference11r2:IP4/ETH/DHCP|DHCP Server]] configuration for a specific interface.

==Additional Security Features in Version 12==

===TLS===

From version 12r1 we support the following cipher suites. The DHE and ECDHE suites provide perfect forward secrecy.

* TLS_RSA_WITH_AES_128_CBC_SHA
* TLS_RSA_WITH_AES_256_CBC_SHA
* TLS_DHE_RSA_WITH_AES_128_CBC_SHA (new)
* TLS_DHE_RSA_WITH_AES_256_CBC_SHA (new)
* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (new)
* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (new)

The following cipher suites have been deactivated and are no longer in use.

* TLS_RSA_WITH_3DES_EDE_CBC_SHA (deactivated)

==Additional Security Features in Version 13r1 ==
===TLS===

'''Note: With 13r1 SR35 we merged-back the TLS functionality from 13r2. So the feature set is identical with the lastest versions.'''

Supported TLS versions:

* TLS 1.0
* TLS 1.1
* TLS 1.2 (new)
* DTLS 1.0
* DTLS 1.2 (new)

Supported ciphers in version 13r1:

* TLS_RSA_WITH_AES_128_CBC_SHA
* TLS_RSA_WITH_AES_256_CBC_SHA
* TLS_DHE_RSA_WITH_AES_128_CBC_SHA
* TLS_DHE_RSA_WITH_AES_256_CBC_SHA
* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
* TLS_RSA_WITH_AES_128_CBC_SHA256 (new)
* TLS_RSA_WITH_AES_256_CBC_SHA256 (new)
* TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (new)
* TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (new)
* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (new)
* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (new)
* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (DTLS only)
* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (DTLS only)
* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (new, DTLS only)
* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (new, DTLS only)

TLS_RSA_WITH_3DES_EDE_CBC_SHA was finally removed and can't be activated in v13r1.

Additionaly we added the configuration of TLS profiles. They can be used to configure the selection and priority of used TLS versions and ciphers.

{|
!style="text-align:left;width:100px;"|Cipher suite
!style="width:100px"|TLS (normal)
!style="width:100px"|TLS (fast)
!style="width:100px"|TLS (secure)
!style="width:100px"|DTLS
|-
|TLS_RSA_WITH_AES_128_CBC_SHA
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_RSA_WITH_AES_256_CBC_SHA
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_RSA_WITH_AES_128_CBC_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_RSA_WITH_AES_256_CBC_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_DHE_RSA_WITH_AES_128_CBC_SHA
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_DHE_RSA_WITH_AES_256_CBC_SHA
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|}

===Random numbers===
For creating private keys for certificates and certificate request, we now use the HMAC-DBRG random number generator based on HMAC-SHA512.

===STARTTLS in SMTP client===
The SMTP client in the firmware and on the app platform now implements STARTTLS for encrypted communication with mail servers.

===myApps Password policy===
{{myApps Password Policy}}

==Additional Security Features in Version 13r2 ==
===TLS===
Supported TLS versions:

* TLS 1.0
* TLS 1.1
* TLS 1.2
* DTLS 1.0
* DTLS 1.2

Supported ciphers in version 13r2:

* TLS_RSA_WITH_AES_128_CBC_SHA
* TLS_RSA_WITH_AES_256_CBC_SHA
* TLS_DHE_RSA_WITH_AES_128_CBC_SHA
* TLS_DHE_RSA_WITH_AES_256_CBC_SHA
* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
* TLS_RSA_WITH_AES_128_CBC_SHA256
* TLS_RSA_WITH_AES_256_CBC_SHA256
* TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
* TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
* TLS_RSA_WITH_AES_128_GCM_SHA256 (new)
* TLS_RSA_WITH_AES_256_GCM_SHA384 (new)
* TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (new)
* TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (new)
* TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (new)
* TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (new)
* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (DTLS only)
* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (DTLS only)
* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (DTLS only)
* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (DTLS only)
* TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (new, DTLS only)
* TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (new, DTLS only)

Major changes in 13r2:
* Added support for GCM cipher suites
* Removed SHA cipher suites from profile "secure"
* Added a new profile "strict"

{|
!style="text-align:left;width:100px;"|Cipher suite
!style="width:100px"|TLS (normal)
!style="width:100px"|TLS (fast)
!style="width:100px"|TLS (high security)
!style="width:100px"|TLS (strict)
!style="width:100px"|DTLS
|-
|TLS_RSA_WITH_AES_128_CBC_SHA
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_RSA_WITH_AES_256_CBC_SHA
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_RSA_WITH_AES_128_CBC_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_RSA_WITH_AES_256_CBC_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_DHE_RSA_WITH_AES_128_CBC_SHA
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_DHE_RSA_WITH_AES_256_CBC_SHA
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_RSA_WITH_AES_128_GCM_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_RSA_WITH_AES_256_GCM_SHA384
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|}

The following TLS versions are activated in the corresponding profiles:

{|
!style="text-align:left;width:100px;"|Version
!style="width:100px"|TLS (normal)
!style="width:100px"|TLS (fast)
!style="width:100px"|TLS (high security)
!style="width:100px"|TLS (strict)
!style="width:100px"|DTLS
|-
|1.2
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|1.1
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|N/A
|-
|1.0
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|}

===myApps brute force protection===
Attackers trying to guess user passwords are blocked by temporarily [[Reference13r3:Concept_myApps#Brute_force_protection|preventing login attempts for an increasing amount of time and generation of events to notify the administrator]].

===IPv4: prevent direct routing between interfaces (since V13r2sr16) ===

Incoming frames directed to another interface are passed directly to this interface by default.
When "IP4/General/Settings/Isolate Interfaces" in the advanced GUI is checked such frames are dropped and the SNMP counter IPROUTINGDISCARDS is incremented.

The corresponding flag can also be set with
!config add IP0 /isolate-interfaces
!config write

==Additional Security Features in Version 13r3 ==
===TLS===
Supported TLS versions:

* TLS 1.0
* TLS 1.1
* TLS 1.2
* TLS 1.3 (new)
* DTLS 1.0
* DTLS 1.2

Supported ciphers in version 13r3:

* TLS_RSA_WITH_AES_128_CBC_SHA
* TLS_RSA_WITH_AES_256_CBC_SHA
* TLS_DHE_RSA_WITH_AES_128_CBC_SHA
* TLS_DHE_RSA_WITH_AES_256_CBC_SHA
* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
* TLS_RSA_WITH_AES_128_CBC_SHA256
* TLS_RSA_WITH_AES_256_CBC_SHA256
* TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
* TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
* TLS_RSA_WITH_AES_128_GCM_SHA256
* TLS_RSA_WITH_AES_256_GCM_SHA384
* TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
* TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
* TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
* TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (DTLS only)
* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (DTLS only)
* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (DTLS only)
* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (DTLS only)
* TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (DTLS only)
* TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (DTLS only)
* TLS_AES_128_GCM_SHA256 (new, TLS 1.3 only)
* TLS_AES_256_GCM_SHA384 (new, TLS 1.3 only)

Major changes in 13r3:
* Added support for TLS 1.3
* Added a new profile "experimental" used for testing of new features. The configuration of that profile is subject to change without notice. So it should not be used for productive environments.
* Removed ciphers TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 and TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 from "strict" profile.

{|
!style="text-align:left;width:100px;"|Cipher suite
!style="width:100px"|TLS (normal)
!style="width:100px"|TLS (fast)
!style="width:100px"|TLS (high security)
!style="width:100px"|TLS (strict)
!style="width:100px"|TLS (experimental)
!style="width:100px"|DTLS
|-
|TLS_RSA_WITH_AES_128_CBC_SHA
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_RSA_WITH_AES_256_CBC_SHA
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_RSA_WITH_AES_128_CBC_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_RSA_WITH_AES_256_CBC_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_DHE_RSA_WITH_AES_128_CBC_SHA
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_DHE_RSA_WITH_AES_256_CBC_SHA
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_RSA_WITH_AES_128_GCM_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_RSA_WITH_AES_256_GCM_SHA384
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_AES_128_GCM_SHA256 (TLS 1.3)
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|-
|TLS_AES_256_GCM_SHA384 (TLS 1.3)
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|}

The following TLS versions are activated in the corresponding profiles:

{|
!style="text-align:left;width:100px;"|Version
!style="width:100px"|TLS (normal)
!style="width:100px"|TLS (fast)
!style="width:100px"|TLS (high security)
!style="width:100px"|TLS (strict)
!style="width:100px"|TLS (experimental)
!style="width:100px"|DTLS
|-
|1.3
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|-
|1.2
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|1.1
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|N/A
|-
|1.0
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|}
=== X.509 certificates ===
13r3 Service Release 10 adds support for additional signature schemes in X.509 certificates with RSA keys:
* sha256WithRSASSAPSS
* sha384WithRSASAAPSS
* sha512WithRSASSAPSS
all with mgf1 as mask generation function.

==Additional Security Features in Version 16r1 ==
===X.509 certificates===
Version 16r1 adds support for ECDSA certificates based on the secp256r1, secp384r1 and secp521r1 elliptic curves.

===TLS===
Major changes in 16r1:
* Added support for ECDSA certificates and cipher suites
* DTLS 1.0 has been removed.
* DHE cipher suites have been removed.
* Consolidation of TLS profiles. We now have three profiles:
{{TLS_profiles}}

Supported TLS versions:
{|
!style="text-align:left;width:100px;"|Version
!style="width:100px"|Profile legacy
!style="width:100px"|Profile normal
!style="width:100px"|Profile strict
!style="width:100px"|DTLS
|-
|1.3
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|-
|1.2
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|1.1
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|-
|1.0
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|}

Supported cipher suites:
{|
!style="text-align:left;width:100px;"|Cipher suite
!style="width:100px"|Profile legacy
!style="width:100px"|Profile normal
!style="width:100px"|Profile strict
!style="width:100px"|TLS 1.0
!style="width:100px"|TLS 1.1
!style="width:100px"|TLS 1.2
!style="width:100px"|TLS 1.3
!style="width:100px"|Perfect forward secrecy
!style="width:100px"|AEAD
|-
|TLS_AES_256_GCM_SHA384

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_AES_128_GCM_SHA256

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|-
|TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|-
|TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|-
|TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|-
|TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA

|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|-
|TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA

|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|-
|TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA

|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|-
|TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA

|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|-
|TLS_RSA_WITH_AES_256_GCM_SHA384

|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_RSA_WITH_AES_128_GCM_SHA256

|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_RSA_WITH_AES_256_CBC_SHA256

|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|-
|TLS_RSA_WITH_AES_128_CBC_SHA256

|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|-
|TLS_RSA_WITH_AES_256_CBC_SHA

|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|-
|TLS_RSA_WITH_AES_128_CBC_SHA

|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|}

Supported signature schemes:
* sha256WithECDSA
* sha384WithECDSA
* sha512WithECDSA
* sha256WithRSAEncryption
* sha384WithRSAEncryption
* sha512WithRSAEncryption
* sha256WithRSAPSSRSAE
* sha384WithRSAPSSRSAE

Supported mask generation functions for RSASSA-PSS:
* mgf1

Supported elliptic curves for ECDSA:
* secp256r1
* secp384r1
* secp521r1

== Session Riding / "Cross-Site-Request-Forgery"==

For safe administration, see [[Howto:Protection against "Cross-Site-Request-Forgery"]].

== IP Phone USB Interfaces ==
Some of the innovaphone hardware phones feature a USB host interface which supports connection of USB headsets (a.k.a. audio and HID devices) and proprietary innovaphone extension modules. No other device types are supported or recognized.

Like all innovaphone devices, the phones run a proprietary operating system (think of it as ''the innovaphone OS''). It has been written from the ground by innovaphone and is not based on any existing operating system such as Windows, Linux or VxWorks. As such, it does not allow execution of any code (e.g. drivers) derived from such systems. Also, the operating system does not allow execution of user code (that is, code that has been crafted by a user and is not integral part of the operating system). Execution of malware is not possible thus.

All headset drivers are entirely written by innovaphone too. No 3rd party code (such as vendor SDKs) are used.

From V12r1 SR14, you have the option to disable the USB port(s) altogether. Also, you can limit its use to audio or HID devices. See [[Reference12r1:Phone/Protect]] for details.

From V12r2 SR21, you can request informations about the connected USB Device via ''!mod cmd USB-HOST port''
<info><port type="hub" port="1"/><port type="device" port="4" vendor="0xb0e" product="0x245d" release="0x118" product_name="Jabra Link 370"/></info>

In addition, a syslog entry is generated.
20190103-140636 USB-DEVICE plugged: vendor=1395 'Sennheiser' product=0051 'Sennheiser USB-ED CC 01' release=0603
20190103-140637 USB-DEVICE unplugged: vendor=1395 'Sennheiser' product=0051 'Sennheiser USB-ED CC 01' release=0603

== DECT Handsets and IP-DECT ==
The current DECT infrastructure components based on the base stations IP1202 and DECT handsets IP64/IP65 are supporting the Enhanced DECT Security (ETSI TS 102 841, GAP.N.35). Starting with version 2.1.4 of the DECT handset firmware also Step B of the DECT Security Roadmap by DECT Forum was implemented, supporting DECT Standard Authentication Algorithm 2 (DSAA2) based on 128 bit AES encryption, which also implies DECT Standard Ciphering Algorithm (DSCA) based on 64 bit DECT encryption with rekeying interval of 60 seconds.

==Conclusion==
Given the fact that today’s IT managers consider threats originating from inside the organisation as (at least) as critical as those originating externally, the only viable solution is a combination of media stream and signalling encryption performed directly by the endpoints.

Fortunately, both relevant signalling protocols in the PBX environment (H.323 and SIP) seem to converge as far as the media stream encryption (SRTP) and the key management are concerned. This should ensure end-to-end compatibility between SIP and H.323 endpoints. The necessary definitions for use of SRTP with H.323 are part of H.235-Annex G, for SIP it is SIPS - SIP via TCP and TLS.
innovaphone has implemented SRTP according to H.235 Annex G as well as according to the SIP/SDP (SIPS/TLS) key management. The TLS is also used for HTTP, it requires an X.509 public key/certificate.infrastructure in place.

As the security of data transfer used for configuration is considered crucial, HTTPS is a mandatory requirement. This implies the existence of an X.509 certificate on each device. innovaphone devices entertain various http-based client connections to foreign http servers (e.g. for voice announcements, configuration provisioning). Since these connections are (at least) as critical as configuration sessions where the device acts as an http server, both proper http digest authentication and also TLS content encryption (https) is implemented by innovaphone.

The use of telnet to access innovaphone devices is deprecated and thus there is no need to address possible security issues related to the telnet access. As a “best practice” rule it is recommended to disable telnet access anyway (which in fact is the default configuration anyway).

While innovaphone devices do support SNMP, they do not allow any modification or retrieval of sensitive data using this mechanism. It is merely meant to facilitate maintaining devices health status. SNMP should be guarded against risk originating externally anyway (e.g. using firewall techniques). Risks originating from inside the organisation are considered less important. innovaphone will thus stay with the current SNMP v1 implementation.

innovaphone systems make extensive use of LDAP queries to synchronize distributed PBX systems. These communications obviously carry sensitive data (although from the very beginning there were no passwords conveyed in clear). innovaphone has implemented TLS for LDAP for inter-PBX communication. Securing LDAP access by clients (i.e. phones) to organisational directory services is considered less important as the conveyed data usually is not as critical. Also, existing directory servers may not support TLS for LDAP.

While 802.1X port security adds some extra barrier against certain types of internal risks, it also creates a number of open issues. Telephones usually are considered to work even if they are currently not authenticated by user. This may be mandatory for emergency calls for example. Use of port security would then mandate the storage of a fixed password within the non-volatile memory of an IP phone. Furthermore, the authentication of the second (PC) port needs to be performed with 802.1.x multiple authentications. innovaphone has implemented 802.1x on all of its devices.

As [[Howto:Protection against Brute Force Attacks | brute force attacks]] are very common these days, it is recommended to limit the ip subnets for configuration access (HTTP access filter). Configure that only registrations with password are allowed. For each object set a complex password or configure them with the [[Reference9:PBX/Objects#Devices |admin password check-mark]]. Set the device field empty at the object when no registration should take place, thus nobody can register at all at this object. Deactivate "unknown registrations" or set them with admin password check-mark. From version 11r1 on, it is recommended to use [[Reference11r1:Concept_H.323_over_TCP/TLS_(H.460.17) | H.323/TLS certificate based registration ]] whenever possible.

===Related Articles===
* [[Reference13r3:Concept_myApps#Brute_force_protection]]
* [[Howto:Protection against Brute Force Attacks]]
* [[Howto:How to physically erase flash memory content]]
* [[Howto:SIPS will work with V7]]
* [[Howto:Certificate_management]]
* [[Reference9:PBX/Config/Security]]
* [[Support:Protection against "Cross-Site-Request-Forgery"]]
* [[Reference12r1:Concept_Reverse_Proxy]]

[[Category:Howto|{{PAGENAME}}]]

Template:TLS profiles

2026-08-10T13:10:24Z

Vsc: Created page with "** legacy - all TLS versions and ciphers for compatibility with legacy endpoints ** normal (default setting) - TLS 1.2 and 1.3 ** strict - TLS 1.3"

** legacy - all TLS versions and ciphers for compatibility with legacy endpoints
** normal (default setting) - TLS 1.2 and 1.3
** strict - TLS 1.3

Reference15r1:PBX/Config/General

2026-08-10T05:49:01Z

Vsc: Undo revision 80336 by Tsbodry (talk)

== Configuration ==

=== Common ===

;PBX Mode: The PBX operating mode
:* '''Off''' - The PBX is disabled. After enabling the PBX a browser refresh is needed to activate additional PBX webpages.
:* '''Master''' - The PBX on this device acts as Master. Within a multisite installation exactly one PBX must be configured as Master.
:* '''Slave''' - The PBX on this device acts as Slave. Within a multisite installation several PBXes can be configured as Slave.
:* '''Standby''' - The PBX on this device acts as Standby for the Master. As long as the master is available, this PBX is not active, but just monitors the Master. If the Master is not available this PBX is active.
:* '''Standby-Slave''' - The PBX on this device acts as Standby for a Slave. As long as the slave is available, this PBX is not active, but just monitors the slave. If the slave is not available this PBX is active.

;System Name: The system Name. On all PBX within a multisite installation the same System Name must be configured. For H.323 endpoints this name is the gatekeeper identifier, for SIP endpoints it is the server name.

;Use as Domain: Uses the ''System Name'' as domain name, together with the name field in the user object the PBX constructs the email address (used for sending emails out ox myPBX). This mechanism is also used for Federation, to federate with other domains.

;PBX Name: The name of the PBX on this device. With this name a PBX is associated to a node. The field 'Name' (not Long Name) of a PBX Node object relates to this name.

;DNS: DNS Name of the PBX. If configured this will be used for myPBX redirects if a client tries to register at a PBX on which the user is not configured.

;Unknown Registrations: If this checkmark is set, the PBX accepts 'unknown' registrations. This means registrations with no matching object configured. If from an endpoint registered in this way a number of an object is dialed, which has no registration active and no 'HW-ID' configured the name used for the registration is configured as 'HW-ID' of this object. This is an easy way to deploy large numbers of phones.

:'''With PBX Pwd only:''' If checked only registrations with a PBX authentication or a verified certificate in case of H.323/TLS are accepted. In this case either "PBX Pwd" or "TLS only" is set in a device generated.

;Reverse Proxy Addresses: Up to 8 IP-Addresses (Mixed IPv4 and IPv6 allowed, but no DNS names) can be entered in this field, separated by comma. Registrations from one of these addresses are assumed to be routed through a Reverse Proxy. To the address '/<certificate name>' can be added to also check the TLS certificate of the Reverse Proxy. If the reverse proxy certificate is to be verified, the certificate or the issuer of the reverse proxy certificate must be trusted in the PBX. (If you use a SAN certificate you have to enter the first SAN-Name)
:Checking only on the certificate is also possible, by omitting the IP-address, eg '/*.domain.de'. Registrations sent with this certificate are considered to be coming over the Reverse Proxy.
:If empty addresses are used, unauthenticated registrations from unknown or internal addresses are not allowed, but any registration must be authenticated, with a password or the certificate from the reverse proxy.
; Assume TLS: If the ''Assume TLS'' checkmark is set, it is assumed, that the reverse Proxy did a successful check of the TLS certificate against the registration name.

;Media relay endpoint/Firewall public IP: For media relay endpoints (e.g. third party SIP phones) the public address of the firewall of the PBX network can be configured. This address is signaled in the SDP to received RTP from the phone. The firewall should have configured a port forwarding to the PBX or the TURN, for the RTP range of the PBX or TURN.

;Media relay endpoint/TURN: If this checkmark is set, the PBX allocates TURN endpoints for calls to or from media relay endpoints, which registerd thru the reverse proxy (e.g. third party SIP phones)

;IP address for App Platform
: The ip address of an App Platform can be configured here, with a DNS name used for it. If myApps uses a host to access the PBX different from the configured DNS name of the PBX, the hostname in any App url, which matches the configured AP DNS, is replaced by the AP IP. This way it is possible to configure a PBX with DNS names and access it with myApps when the DNS is not yet set up. If the checkmark ''Operation without DNS'' is set as well any matching DNS name is replaced also when an App service requests the URL of another App service (Example: Users requesting the URL of Devices for provisioning) and in the URL sent to the App services itself (Example: Devices uses this URL to construct the URL set at devices for the Devices registration).

: Note that this mode is intended to be able to run the PBX using DNS names while the DNS is not yet in place. Once the DNS is up and running, neither the DNS name of the AP nor its IP address should be configured here.

;Music On Hold URL: A URL for the Music On Hold. This file is read by the PBX using HTTP and sent to a held endpoint via RTP. The format of this URL is

:'''<nowiki>http://<addr>/<file>.$coder?coder=g711a,g711u,g722,g723,g729,opus-nb,opus-wb&repeat=true</nowiki>'''. <addr> is the IP address of the http server, no dns name is allowed here. <file> is the filename. $coder will be replaced by the actual coder used.

:Parameters: ''coder=g729,g711a,g711u,g723,opus-nb,opus-wb'' is the list of available coders. Only these coders must be specified for which a corresponding file exists. ''repeat=true'' should be specified in order to loop the file endlessly. ''random=true'' can be used to start the music on hold on a random point (this will work only if the URL is not local though).

:By default the built-in Music-On-Hold is played (Pseudo URL: "MOH?coder=g729,g711a,g723&repeat=true"). You can also play a dial tone (Pseudo URL "TONE") or a ring-back tone (Pseudo URL "TONE?tone=ringback").

:The maximum length of the URL is limited to 500 characters (bytes).

:If you configure a wrong (or invalid) URL then you will have silence as MOH. To prevent this situation when the MoH for some specific context/user(see below) is missing and silence is played instead of any MoH, an additional parameter ''fallback=true'' is available. If the file provided in the URL is missing (HTTP Error 404 Not Found is delivered by the HTTP Server) and the parameter ''fallback'' is provided, the default MoH will be played instead of silence. To use a custom file as fallback MoH, instead of default MoH, any file name can be provided with the ''fallback'' parameter: e.g. ''fallback=other_filename''. The file other_filename.g7xx must be placed in the same folder as a file provided with URL. A special filename ''fallback=ringback'' can be used to generate a ringback tone (equivalent to ''TONE?tone=ringback'') instead to play an alternative file.

:Within the URL %<id> can be used to put in some context information of the call. The information refers to the party which has put the receiving party on hold. For information about the receiving party itself, the id has to be preceded by '.' (e.g. '''.l''').

:'''l''' Long Name
:'''h''' Name (H.323 id)
:'''n''' Number
:'''N''' Node
:'''P''' PBX
:'''d''' Diverting Name
:'''#d''' Diverting Number

: See [[Howto:Dynamic_MOH]] for more details on how to use dynamic music on hold.

;External Music On Hold: To offload the device from playing the Music on hold, the Music On Hold can be played by a separate device. This device can register with a name configured here. To retrieve the Music On Hold a call is sent to this device. For each held endpoint a call is sent.

;Response Timeout: Global timeout (in seconds) after which any action for no response is taken (e.g. Call Forward on No Response). A timeout configured at any object overrides this value.

;Dial Complete Timeout: Global timeout (in seconds) after which any action for incomplete dialed number is taken (e.g. incomplete destination at trunk object).

;No. of Regs w/o Pwd: Number of registration without password authentication which are allowed per user. If 0 is configured no registration without password is possible.
Pls. note that registrations from 127.0.0.1 w/o password will be accepted anyway

;Security block time(s): Time for which a registration to a user is blocked after attempt with wrong password. Default is 20s. With a value of 0 this features is turned off.

;Recall Timeout: A value configured here enables recall after transfer. If a call is transferred and not answered within this time, the call is sent back to the transferring endpoint.

;Chat no Attachments: If checked, no file attachments are allowed in chats for any user

;Retries on busy (14s): Number of retries (Each attempt runs for 14 seconds) of blind transfer to a busy endpoint, before a recall back to the initiator is executed. During an attempt, the PBX waits to see if the target is free, and then delivers the call. The default value are 4-retries if the field is empty. If there is a 0 configured no further (in addition to the initial) will be executed. (This function depends on the ''Recall Timeout'' so the ''Recall Timeout'' must not be empty)

;Max Call Duration (h): Number of hours until a call with media is disconnected automatically. Affects all calls with initialized media channels signalled via PBX.

;Group Default Visibility: Defines additional visibility for active group members. These are added to the visibility rights derived from the [[{{NAMESPACE}}:PBX/Objects/Visibility | Visibility settings]] in user or template definitions. Note that changes made here only take effect after a re-registration.

;Presence with Alert: Enable presentation of presence on phone upon alert. Setting applies for all PBX users.

;Enable External Transfer: Unless this checkbox is set any attempt to transfer an external call back to an external destination will result in disconnection of the call.

;No CLIR on Internal calls: If checked numbers are displayed even if received with presentation restricted. When sending a call presentation restricted can still be set and should be honored by a public network.

;Media Relay:
:;Off: No Media Relay is done in the PBX
:;On: All media traffic is routed through the PBX. With the '''No Media Relay if Addresses are identical or private''' checkmark, this is not done if the two call endpoints registration addresses are either private or equal (i.e. external endpoints behind the same NAT router). To identify an address as private the "Private Networks" configuration from ''IP4/General/Settings'' is used.
:;Auto: Media traffic is routed through the PBX if calls are between private and public registration addresses but not for calls between private and private or public and public registration addresses. To identify an address as private the "Private Networks" configuration from ''IP4/General/Settings'' is used. In v11 this was the behaviour if ''RTP Proxy'' was ''on''.
: Please note that when media relay is in effect for a call, '''video is not working'''. With ICE (available from v12r1), media relay in the PBX should be obsolete except for special applications. Check ''On'' or ''Auto'' only if you need to have this, since it creates CPU load on the PBX.

;Generate CDRs: If this checkbox is set, the PBX generates CDRs for all calls. For details, refer to the [[{{NAMESPACE}}:Concept_Call_Detail_Record_CDR_PBX|CDR description article]].

;Reverse Lookup URL
: A String in the LDAP URL Format according [https://tools.ietf.org/html/rfc2255 RFC2255] which will be used by the PBX to make a lookup for all external numbers.
: Number resolutions will be forwarded to internal applications like generated CDRs, Phone App etc..
: Example: ''ldaps://ap.innovaphone.com/dc=entries?givenname,sn,company?sub?(metaSearchNumber=+%n)?bindname=innovaphone.com\contacts''
:* dn: ''dc=entries''
:* attributes: ''givenname,sn,company''
:* scope: ''sub''
:* filter: ''(metaSearchNumber=+%n)''
:** %n is a placeholder for the given cgpn
:* extension: ''bindname=innovaphone.com\contacts''
:** The username for the authentication.
:'''Variables'''
:* %n - cgpn
:* %u - h323 name of the current object
:'''Password''': Password to authenticate access for the used ldap source. Leave empty if not required.
: Examples for use of different ldap directories are listed in the [[{{NAMESPACE}}:Concept_Number_Resolution_and_LDAP#PBX_Configuration|Concept Article]]

;Logo URL
:The URL to a customized logo image that will be displayed on the phones. Leave empty to keep the standard logo. The image size should be 220x150px or less with 24Bit color deep or less and an RGB range. The file format should be PNG or JPEG.

;Route Root-Node External Calls to: Destination object (Long Name) of Root-Node external calls. This configuration option is available on the Master or Standby PBX only. Any call which cannot be terminated inside the PBX is sent to this destination as long as neither the source nor the destination of the call can be associated with a node with a PBX configured. This object must be assigned to this PBX.
:'''For calls from local PBX only''': If set on a master, calls from a slave are not sent to this destination but sent back to the slave where the call came from. On the slave the call is then sent to a destination configured with 'Route Root-Node External Calls to'.

;Route PBX-Node External Calls to: Destination object (Long Name) of PBX-Node external calls. Any call which cannot be terminated inside the PBX is sent to this destination as long as the source nor the destination of the call can be associated with the node of this PBX. If a call is sent from or to an object defined inside the node of this PBX or in a node hierarchically below the node of this PBX the call is associated to the node of this PBX. This object must be assigned to this PBX, that is, it has to register to this PBX.

;Route Internal Calls to: Destination object (Long Name) to which any call is sent for which a PBX internal destination was found, except for those calls that originated from that object. This can be used to apply special routing on PBX internal calls.

;Escape Dialtone from: The PBX object (Long Name) to which a call is made to get a dialtone if a dialtone is configured for the escape of a node. As above, this object must be assigned to this PBX.

;Prefix for Intl/Ntl/Subscriber/Area-Code/Country-Code: Prefixes to be used to map International, National and Subscriber numbers.
:* '''International Prefix''' (<code>000</code> in Germany).
:* '''National Prefix''' (<code>00</code> in Germany).
:* '''Subscriber''' (in Germany, <code>0</code> is a commonly used trunk line access code).
::The SubscriberID is used for hotkey-actions within myAPPs-launcher. By use of node-objects, adjust the Subscriber Prefix in the respective [[{{NAMESPACE}}:PBX/Objects/Node#Number_Mapping_.28International.2C_National.2C_Subscriber_Prefix.29|node object number mapping]].
::For myPBX-launcher hotkeys, refer to the [[{{NAMESPACE}}:Phone/User/Directories#Dialing_location|dialing location settings]].

:* '''Area-Code''' (in Germany for example, the town Mannheim has area code <code>621</code>).
:* '''Country-Code''' (for Germany, <code>49</code> would be used)

: These settings resemble the same settings found in the [[{{NAMESPACE}}:PBX/Objects/Node | Node]] and [[{{NAMESPACE}}:PBX/Objects/PBX | PBX]] object. However, they apply to the ''root'' node instead (and should be consistent through all PBXs in a multi-PBX system).
'''Max. length internal number'''

In the phone and softphone App: If the number, witch is dialed is 7 digits or longer, the subscriber prefix is added. (A reset of the pbx and the myApps is needet after changes.)
;Adjust LDAP results for e.164: Add a "+" prefix to an PBX-internal LDAP-contact-search result. This is used for 3rd-party- and DECT-phones which are not able to benefit from the Dialing Location settings in case of LDAP-search in an E.164-setup. See also [[{{NAMESPACE}}:Concept_Number_Adjustments_%28Dialing_Location%29#PBX_database_used_as_LDAP_database|concept description]].

;Tones: The tones scheme to be used for PBX generated dialtones. This applies to dialtones generated for node prefixes, ringback on transfer and some more.

=== Slave PBX ===

If the PBX is operated in Slave mode, then the Slave PBX section is displayed

;Registration: The VOIP protocol used for the registration to the master. Possible choices are H.323, H.323/TCP or H.323/TLS.

;Master: The IP address of the PBX master

;License Only: If set, the PBX obtains license from master, but acts as master in all other respects.

;Alternate Master: The IP address of an alternative PBX master (standby, if available)

;Password: The password to be used for registration at the Master as configured in the corresponding PBX Object (The length of the password is limited to 16 characters)

;Master GK-ID: The System Name/Gatekeeper ID of the PBX Master were will register (Optional, usually used for DynPBX).

;Replication: This parameter allows you to select the replication style for the slave PBX: either ''All'' or ''Local'' (only users that need to be known in this PBX). For the replication process the [[Reference9:PBX/Config/Security|PBX Password]] is used which have to be the same password on all PBXes in the system.

;dyn PBX ID: This parameter allows to set replication from a specific DynPBX configured on the Master Device.

;Use local static User DB: A dynPBX has also this checkmark. The database of the main PBX is used, but be careful due to the increased memory usage. The dynPBX will create its own PBX datastructure which allocates memory.

;Route Master calls if no Master to: If the master is not available, master calls are sent to this destination. Destination has to be an object with active registration.

;Max Calls to Master/No Reroute: This parameter can be used to limit the calls to the master. If a call is sent to the master and there are already calls to/from the master equal to or exceeding this value, the call is rejected if '''No Reroute''' is set or is handled as if the master was not available otherwise.

;License Limits: Here we can set limit of licensing for this Slave PBX for Port, Mobility, Operator and Softwarephone.

For complete replication from master to slave, check also password in [[Reference9:PBX/Config/Security#PBX_password]]

=== Standby PBX ===

If the PBX is operated in Standby mode, then the Standby PBX section is displayed

;Master: The IP address of the PBX master

;Replicate from Master: Turns on full replication from the master PBX

;use TLS: Use LDAPS (TLS) instead of LDAP (TCP).

For complete replication from master to slave or standby, check also password in [[Reference9:PBX/Config/Security#PBX_password]]

Reference14r2:MyApps Plugin for Virtual Desktops

2026-08-06T07:28:56Z

Vsc:

[[Category:Concept|Apps]]
== Description ==
A softphone running at a terminal server (Citrix, Windows, ...) has the problem that audio and video streams start and terminate at the server.
Received audio from remote peer at the server must be transmitted to the local client for playback and audio delivered by the audio device must be also transmitted from the local client to the server for transmission to remote peer.
This transmission of the audio stream between server and client adds a delay which makes the communication impossible.
Video suffers from the same limitations.

The myApps Virtual Desktop Plugin enables media data to be transferred to the local client in terminal server environments.
== Applies To ==
* innovaphone PBX from version 14r2
* Client OS: Windows, Linux<ref>VDI Plugin for Linux only connects to Citrix or VMWare Horizon, RDP still not supported</ref>(Ubuntu 22 or 23, RangeeOS<ref>RangeeOS is listed due to a customer testimonial. No tests have been conducted by innovaphone. Tests were done using myapps 14r2sr3, RangeeOS Firmware 12.00 build 203 ff and Citrix Workspace 2311. (Workspace version 2402 & 2405 have a bug with USB redirection and 2408 is not starting reliably)</ref>, IGEL OS<ref>IGEL OS: available at [https://app.igel.com/myAppsPlugin/15.1.455+1 IGEL App Portal]</ref>) or MacOS operating systems
* Hypervisor OS: Citrix, Windows Terminal Server environments and VMWare Horizon<ref>VMWare Horizon OS is listed due to a customer testimonial. No tests have been conducted by innovaphone.</ref> 
<references/>

== Requirements ==
* innovaphone PBX
* innovaphone myApps native Client
* innovaphone myApps Plugin
Minimum required firmware version for all products mentioned is at least 14r2final – we recommend using the latest version.
== Concept ==
The myApps Plugin at the client is in charge of all tasks related to the media streams and the management of the Audio/Video devices. For instance:
* start or stop an audio/video device
* gathering of the ICE candidates
* connect to a remote peer with the ICE protocol
* start a ringing device
* rendering of video

But we now need a way of communicating between the myApps running at the terminal server and the myApps plugin running at the terminal client in order to carry out all these actions.

Main VDI Platforms (Citrix, Windows, VMware) provide a way of communicating between server and client through Virtual Channels:

* [https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/technical-overview/virtual-channels Citrix technical overview]
* [https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX691230 Citrix support article summary]
* [https://learn.microsoft.com/en-us/windows/win32/termserv/using-terminal-services-virtual-channels Microsoft Remote Desktop Services virtual channels]

=== Call signaling ===
The VDI Plugin has no connection to the PBX. Signaling is still done at the terminal server by the myApps client.

=== Audio transmission ===
The plugin connects Audio, ICE and DTLS directly to the other endpoint. Since Audio itself does not use virtual channels, the plugin on the client must be able [[Howto:What_Ports_are_used_for_Signaling_and_Voice_Traffic_in_SIP_and_H.323%3F#ICE_STUN_TURN|to reach the TURN/STUN server via port 3478]].

== Configuration ==
'''Citrix Workspace app must first be installed on all platforms. This is necessary because the myApps plugin must copy a .dll (Windows) / .so (MacOS/Linux) into the Citrix installation directory. '''
For this to work, the Citrix installation directory must be in the %ProgramFiles(x86)% or %ProgramFiles% directory.

=== Windows ===
The myApps Plugin .msi must be installed or deployed at the Thin-Client and does not require any configuration.

=== MacOS ===
Install the myAppsPlugin.dmg or .pkg at the Thin-Client and does not require any configuration.

=== Linux ===
Update your Linux PC first:

'''sudo apt-get update'''

Download latest Citrix Workspace App (Mar 7, 2024) for Debian and x86_64 platform:

'''https://www.citrix.com/downloads/workspace-app/linux/workspace-app-for-linux-latest.html'''

Citrix Workspace app needs '''libwebkit2gtk-4.0-37''' packet and this packet is not available in Ubuntu-24.04 version.

Install it at your Linux PC:

https://docs.citrix.com/en-us/citrix-workspace-app-for-linux/install.html

'''sudo apt install -f ./icaclient_<version>._amd64.deb'''

Install (or update) now the myApps Plugin:

'''sudo apt install -f ./myAppsPlugin.deb'''

Headset Buttons:

*Jabra: Create a file sudo <your-favorite-text-editor> /etc/udev/rules.d/50-udev-java.rules
**Add <code>ATTRS{idVendor}=="0b0e", MODE="0666", GROUP="users"</code> as content. After creating the udev file (as root), reload the udev rules using: <code>sudo udevadm control --reload</code>
*Epos: Create a file sudo <your-favorite-text-editor> /etc/udev/rules.d/50-udev-epos.rules
** Add <code>ATTRS{idVendor}=="1395", MODE="0666", GROUP="users"</code> as content. After creating the udev file (as root), reload the udev rules using: <code>sudo udevadm control --reload</code>
*Plantronics: Create a file sudo <your-favorite-text-editor> /etc/udev/rules.d/50-udev-plantronics.rules
** Add <code>ATTRS{idVendor}=="047f", MODE="0666", GROUP="users"</code> as content. After creating the udev file (as root), reload the udev rules using: <code>sudo udevadm control --reload</code>
* Snom: Create a file sudo <your-favorite-text-editor> /etc/udev/rules.d/50-udev-snom.rules
** Add <code>ATTRS{idVendor}=="251c", MODE="0666", GROUP="users"</code> as content. After creating the udev file (as root), reload the udev rules using: <code>sudo udevadm control --reload</code>
* Yealink: Create a file sudo <your-favorite-text-editor> /etc/udev/rules.d/50-udev-yealink.rules
** Add <code>ATTRS{idVendor}=="6993", MODE="0666", GROUP="users"</code> as content. After creating the udev file (as root), reload the udev rules using: <code>sudo udevadm control --reload</code>

No additional configuration required.

=== Configuration on the Terminalserver ===
The Softphone App at the terminal server does not require any additional configuration.

== How it works ==
User starts the VDI software (Citrix Workspace App or Windows Remotedesktop) needed to connect to a remote server.

This software automatically starts the myApps Plugin. No user action required.

The user starts myApps at the server for the Softphone App. myApps discovers that it is running in terminal server environment and will connect to the plugin which was already started by the VDI software.

The user does not need to have any knowledge about the myApps Plugin.

== Known issues ==
* The audio module in the MyApps Plugin for Linux/IgelOS has no echo cancellation. It is therefore recommended to use a headset, as headsets usually have their own echo cancellers.
* Webcam and remote videos must be rendered over the Softphone App but for the time being a native window is opened at the terminal client (only for the Windows Plugin)
* Connecting to a conference or 3rd party conference does not transmit video as video starts in the Javascript code of the Softphone App and Javascript has no access to the local webcam at the remote server.
**Video is displayed but with delay due to the rendering process.
**Citrix may provide access to the local webcam internally and the webcam may be available but remote peer will probably experience delay of the received video.
* When MyApps is used as a Citrix Published App, notification pop-ups cannot be displayed. This is because Citrix does not recognize the notifications as part of MyApps and therefore does not show them as part of the published app. If the full desktop is used in Citrix, the notifications function correctly.
* Start of AppSharing remains at the terminal server but the transmission of the media now starts at the local client.
* The MyApps Plugin for macOS supports only Citrix Workspace, the "Windows-App" from Microsoft is currently not supported
 We need to implement an exception for appSharing in the future as the transmission must happen at the server.
 For the time being the appSharing is transmitted to the client and forwarded to the remote peer adding some delay due to this tranmission between server and client (only for the Windows Plugin)

==Troubleshooting==
If the problem still exists after trying the OS-specific hints below, open a support ticket and send a trace from the myApps client (remote) with App and Browser option. Please send also all myAppsPlugin-x.txt and myAppsRemote-x.txt trace files from the myApps-plugin on the local PC.

=== Troubleshooting Windows ===
If Citrix is used as a terminal server environment:
#Citrix must be installed '''BEFORE''' the plugin
#Check in "C:/program files/Citrix/ICA Client" folder, there is the .dll myAppscitrixremoteserviesvc.dll
#Check in the registry, that: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Citrix\ICA Client\Engine\Configuration\Advanced\Modules\ICA 3.0 is there. "VirtualDriverEx" must be there with the value: InnovaphoneCitrixPlugin
#In Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Citrix\ICA Client\Engine\Configuration\Advanced\Modules\InnovaphoneCitrixPlugin as Drivename and DrivenameWin32 you should find the .dll as value and as innovaphone path the path of the plugin for the file myAppsplugin

Dump files are in the trace folder c:\users\$user\Appdata\local\innovaphone\myAppsPlugin if client crash at start.

'''Remote desktop (Windows)'''

After installing the plugin, check this registry folder:

Computer\HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default\AddIns\innovaphoneRemoteServicesSvc64

and check as "Name" the path of the .dll <--- c:\program files(x86)\iinnovaphone\myAppsPlugin\myAppsRemoteServiceSvc64.dll

check that the .dll exist in the mentioned direcotry and the plugin.

'''Disable Echo Canceler (Windows PC)'''

Computer\HKEY_CURRENT_USER\Software\innovaphone\myApps einen neuen Eintrag erstellen:

Type: DWORD (REG_DWORD)

Name: disableEchoCanceller

Value: 1 ( or use, Value: 0 to enable the Echo Canceller)

=== Troubleshooting Linux ===

'''Citrix Workspace App must be installed before the myAppsPlugin'''

Innovaphone Plugin is installed under /opt/innovaphone/'''myAppsPlugin''' and in /opt/Citrix/ICAClient/'''myAppsCitrixPlugin.so'''

myAppsCitrixPlugin.so library is called by the Citrix Workspace App and this library opens the myAppsPlugin.

There is a file in the Citrix installation called module.ini (/opt/Citrix/ICAClient/config/module.ini). Inside this file the myApps Citrix Plugin library is included:

- VirtualDriver entry must contain myAppsCitrixPlugin

- a line with '''myAppsCitrixPlugin=On''' must exist and

Following directory '''/var/log/apps/myAppsPlugin/''' must also exist for the log files with write permission for everyone (drwxrwxrwx)

====Audio Quality issues (e.g. choppy audio)====
If you run into audio quality when using myapps on Linux, the following configuration is recommended:

* Use Pipewire as the audio server
* Set the system-wide sample rate (default 44.1 kHz) to 48 kHz, since most USB headsets (e.g. Jabra) operate at 48 kHz.

You need to apply settings on OS level, since the audio backend and sample rate are operating system settings and cannot be controlled by the application.

You can check the Active audio server and sample rate with the following command:

<code>pactl info</code>

Based on your language-settings you will get a different output.
But you want to look for something like "Server Name" and "Default-Sample-Specification".

The expected results are (Language set to English):

Server Name: pulseaudio

Default Sample Specification: s16le 2ch 48000Hz

If you use pipewire you will get something like this:

Server Name: PulseAudio (on PipeWire 1.4.2)

Default Sample Specification: float32le 2ch 48000Hz

=== Troubleshooting MacOS ===

'''Citrix Workspace App must be installed before the myAppsPlugin'''

In /Library/Application Support/Citrix/PlugIns

must exist myAppsCitrixPlugin.plugin -> /Application/myappsPlugin.app/Contents/PlugIns/myapps_citrix_plugin.plugin

under:

/Users/.../Library/Application Support/Citrix Receiver

there is a file called Modules. Inside this file the myApps Plugin is included:

- VirtualDriver entry must contain myAppsCitrixPlugin

- a line with myAppsCitrixPlugin=On must exist

- and another line with [myAppsCitrixPlugin] too

both things are done during the installation. In case something is not working must check that the link to the plugin exists and that the modules file contains these entries.

And under /Users/.../Library/Containers/com.innovaphone.myapps-plugin-14r2/Data/Documents a log file is created: myAppsPlugin.txt

=== Troubleshooting Citrix ===
A Virtual Channel Policy must be added to the Registry at the '''Citrix Server''':

Create '''VCPolicies''' folder under '''HKLM/Software/Policies/Citrix''' if it does not exist.

Create '''VCPolicies''' folder under '''HKLM/Software/WOW6432Node/Policies/Citrix''' if it does not exist.

Create a REG_MULTI_SZ entry with the name '''VirtualChannelWhiteList'''. This entry must contain as value: '''INNOHDX,C:\Program Files (x86)\innovaphone\myApps\myApps.exe'''

=== Troubleshooting RTP Stream ===

You can analyze the RTP stream with the switch "--record-rtp-stream"

* RTP reception after Echo Canceller and JitterBuffer
* Audio from microphone and send to RTP

You have to start the myApps client as follows: myApps.exe --record-rtp-stream

After the call, you can find the audio files in the folder: C:\Users\...\AppData\Local\innovaphone\myApps

Tool to listen to the RTP stream: Audacity

Go to: File / Import / Raw Data and open the Folder with the Rtp stream and select the file.

For RTP-Send and RTP-Recv Data, use the Audio Codec G711 -> A-Law and 8000

For the Wave-in (out) Data Use Signed 16-bit PCM and 8000 Abtastrate

==Hints==
If all users would like to start with a clean, fresh appproxy (eg to be sure that all cached data is re-retrieved), you can add the appproxy directory to the 'Ausschlussliste - Verzeichnisse'/'Exclusion list - directories' for each user:
* Open Citrix Studio
* Open Policies in the left navigation pane (Configuration/Policies)
* Edit or Create an exisiting policy (Upon create you can filter for 'profile' or 'exclusion'). Search for 'Profile Management/Exclusion list – directories' or 'ProfilverwaltungAusschlussliste Verzeichnisse'.
* Select Exclusion list - directories and click Add.
* Add 'AppData\Local\innovaphone\myApps\appproxy'

== Related Articles ==

* https://wiki.innovaphone.com/index.php?title=Reference14r2:Concept_myApps
* https://wiki.innovaphone.com/index.php?title=Reference14r2:Concept_App_SoftphoneApp

Reference14r2:MyApps Plugin for Virtual Desktops

2026-08-06T07:18:46Z

Vsc: /* Requirements */

[[Category:Concept|Apps]]
== Description ==
A softphone running at a terminal server (Citrix, Windows, ...) has the problem that audio and video streams start and terminate at the server.
Received audio from remote peer at the server must be transmitted to the local client for playback and audio delivered by the audio device must be also transmitted from the local client to the server for transmission to remote peer.
This transmission of the audio stream between server and client adds a delay which makes the communication impossible.
Video suffers from the same limitations.

The myApps Virtual Desktop Plugin enables media data to be transferred to the local client in terminal server environments.
== Applies To ==
* innovaphone PBX from version 14r2
* Client OS: Windows, Linux<ref>VDI Plugin for Linux only connects to Citrix or VMWare Horizon, RDP still not supported</ref>(Ubuntu 22 or 23, RangeeOS<ref>RangeeOS is listed due to a customer testimonial. No tests have been conducted by innovaphone. Tests were done using myapps 14r2sr3, RangeeOS Firmware 12.00 build 203 ff and Citrix Workspace 2311. (Workspace version 2402 & 2405 have a bug with USB redirection and 2408 is not starting reliably)</ref>, IGEL OS<ref>IGEL OS: available at [https://app.igel.com/myAppsPlugin/15.1.455+1 IGEL App Portal]</ref>) or MacOS operating systems
* Hypervisor OS: Citrix, Windows Terminal Server environments and VMWare Horizon<ref>VMWare Horizon OS is listed due to a customer testimonial. No tests have been conducted by innovaphone.</ref> 
<references/>

== Requirements ==
* innovaphone PBX
* innovaphone myApps native Client V14r2
* innovaphone myApps Plugin V14r2
* Firmware V14r2 final

== Concept ==
The myApps Plugin at the client is in charge of all tasks related to the media streams and the management of the Audio/Video devices. For instance:
* start or stop an audio/video device
* gathering of the ICE candidates
* connect to a remote peer with the ICE protocol
* start a ringing device
* rendering of video

But we now need a way of communicating between the myApps running at the terminal server and the myApps plugin running at the terminal client in order to carry out all these actions.

Main VDI Platforms (Citrix, Windows, VMware) provide a way of communicating between server and client through Virtual Channels:

* [https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/technical-overview/virtual-channels Citrix technical overview]
* [https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX691230 Citrix support article summary]
* [https://learn.microsoft.com/en-us/windows/win32/termserv/using-terminal-services-virtual-channels Microsoft Remote Desktop Services virtual channels]

=== Call signaling ===
The VDI Plugin has no connection to the PBX. Signaling is still done at the terminal server by the myApps client.

=== Audio transmission ===
The plugin connects Audio, ICE and DTLS directly to the other endpoint. Since Audio itself does not use virtual channels, the plugin on the client must be able [[Howto:What_Ports_are_used_for_Signaling_and_Voice_Traffic_in_SIP_and_H.323%3F#ICE_STUN_TURN|to reach the TURN/STUN server via port 3478]].

== Configuration ==
'''Citrix Workspace app must first be installed on all platforms. This is necessary because the myApps plugin must copy a .dll (Windows) / .so (MacOS/Linux) into the Citrix installation directory. '''
For this to work, the Citrix installation directory must be in the %ProgramFiles(x86)% or %ProgramFiles% directory.

=== Windows ===
The myApps Plugin .msi must be installed or deployed at the Thin-Client and does not require any configuration.

=== MacOS ===
Install the myAppsPlugin.dmg or .pkg at the Thin-Client and does not require any configuration.

=== Linux ===
Update your Linux PC first:

'''sudo apt-get update'''

Download latest Citrix Workspace App (Mar 7, 2024) for Debian and x86_64 platform:

'''https://www.citrix.com/downloads/workspace-app/linux/workspace-app-for-linux-latest.html'''

Citrix Workspace app needs '''libwebkit2gtk-4.0-37''' packet and this packet is not available in Ubuntu-24.04 version.

Install it at your Linux PC:

https://docs.citrix.com/en-us/citrix-workspace-app-for-linux/install.html

'''sudo apt install -f ./icaclient_<version>._amd64.deb'''

Install (or update) now the myApps Plugin:

'''sudo apt install -f ./myAppsPlugin.deb'''

Headset Buttons:

*Jabra: Create a file sudo <your-favorite-text-editor> /etc/udev/rules.d/50-udev-java.rules
**Add <code>ATTRS{idVendor}=="0b0e", MODE="0666", GROUP="users"</code> as content. After creating the udev file (as root), reload the udev rules using: <code>sudo udevadm control --reload</code>
*Epos: Create a file sudo <your-favorite-text-editor> /etc/udev/rules.d/50-udev-epos.rules
** Add <code>ATTRS{idVendor}=="1395", MODE="0666", GROUP="users"</code> as content. After creating the udev file (as root), reload the udev rules using: <code>sudo udevadm control --reload</code>
*Plantronics: Create a file sudo <your-favorite-text-editor> /etc/udev/rules.d/50-udev-plantronics.rules
** Add <code>ATTRS{idVendor}=="047f", MODE="0666", GROUP="users"</code> as content. After creating the udev file (as root), reload the udev rules using: <code>sudo udevadm control --reload</code>
* Snom: Create a file sudo <your-favorite-text-editor> /etc/udev/rules.d/50-udev-snom.rules
** Add <code>ATTRS{idVendor}=="251c", MODE="0666", GROUP="users"</code> as content. After creating the udev file (as root), reload the udev rules using: <code>sudo udevadm control --reload</code>
* Yealink: Create a file sudo <your-favorite-text-editor> /etc/udev/rules.d/50-udev-yealink.rules
** Add <code>ATTRS{idVendor}=="6993", MODE="0666", GROUP="users"</code> as content. After creating the udev file (as root), reload the udev rules using: <code>sudo udevadm control --reload</code>

No additional configuration required.

=== Configuration on the Terminalserver ===
The Softphone App at the terminal server does not require any additional configuration.

== How it works ==
User starts the VDI software (Citrix Workspace App or Windows Remotedesktop) needed to connect to a remote server.

This software automatically starts the myApps Plugin. No user action required.

The user starts myApps at the server for the Softphone App. myApps discovers that it is running in terminal server environment and will connect to the plugin which was already started by the VDI software.

The user does not need to have any knowledge about the myApps Plugin.

== Known issues ==
* The audio module in the MyApps Plugin for Linux/IgelOS has no echo cancellation. It is therefore recommended to use a headset, as headsets usually have their own echo cancellers.
* Webcam and remote videos must be rendered over the Softphone App but for the time being a native window is opened at the terminal client (only for the Windows Plugin)
* Connecting to a conference or 3rd party conference does not transmit video as video starts in the Javascript code of the Softphone App and Javascript has no access to the local webcam at the remote server.
**Video is displayed but with delay due to the rendering process.
**Citrix may provide access to the local webcam internally and the webcam may be available but remote peer will probably experience delay of the received video.
* When MyApps is used as a Citrix Published App, notification pop-ups cannot be displayed. This is because Citrix does not recognize the notifications as part of MyApps and therefore does not show them as part of the published app. If the full desktop is used in Citrix, the notifications function correctly.
* Start of AppSharing remains at the terminal server but the transmission of the media now starts at the local client.
* The MyApps Plugin for macOS supports only Citrix Workspace, the "Windows-App" from Microsoft is currently not supported
 We need to implement an exception for appSharing in the future as the transmission must happen at the server.
 For the time being the appSharing is transmitted to the client and forwarded to the remote peer adding some delay due to this tranmission between server and client (only for the Windows Plugin)

==Troubleshooting==
If the problem still exists after trying the OS-specific hints below, open a support ticket and send a trace from the myApps client (remote) with App and Browser option. Please send also all myAppsPlugin-x.txt and myAppsRemote-x.txt trace files from the myApps-plugin on the local PC.

=== Troubleshooting Windows ===
If Citrix is used as a terminal server environment:
#Citrix must be installed '''BEFORE''' the plugin
#Check in "C:/program files/Citrix/ICA Client" folder, there is the .dll myAppscitrixremoteserviesvc.dll
#Check in the registry, that: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Citrix\ICA Client\Engine\Configuration\Advanced\Modules\ICA 3.0 is there. "VirtualDriverEx" must be there with the value: InnovaphoneCitrixPlugin
#In Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Citrix\ICA Client\Engine\Configuration\Advanced\Modules\InnovaphoneCitrixPlugin as Drivename and DrivenameWin32 you should find the .dll as value and as innovaphone path the path of the plugin for the file myAppsplugin

Dump files are in the trace folder c:\users\$user\Appdata\local\innovaphone\myAppsPlugin if client crash at start.

'''Remote desktop (Windows)'''

After installing the plugin, check this registry folder:

Computer\HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default\AddIns\innovaphoneRemoteServicesSvc64

and check as "Name" the path of the .dll <--- c:\program files(x86)\iinnovaphone\myAppsPlugin\myAppsRemoteServiceSvc64.dll

check that the .dll exist in the mentioned direcotry and the plugin.

'''Disable Echo Canceler (Windows PC)'''

Computer\HKEY_CURRENT_USER\Software\innovaphone\myApps einen neuen Eintrag erstellen:

Type: DWORD (REG_DWORD)

Name: disableEchoCanceller

Value: 1 ( or use, Value: 0 to enable the Echo Canceller)

=== Troubleshooting Linux ===

'''Citrix Workspace App must be installed before the myAppsPlugin'''

Innovaphone Plugin is installed under /opt/innovaphone/'''myAppsPlugin''' and in /opt/Citrix/ICAClient/'''myAppsCitrixPlugin.so'''

myAppsCitrixPlugin.so library is called by the Citrix Workspace App and this library opens the myAppsPlugin.

There is a file in the Citrix installation called module.ini (/opt/Citrix/ICAClient/config/module.ini). Inside this file the myApps Citrix Plugin library is included:

- VirtualDriver entry must contain myAppsCitrixPlugin

- a line with '''myAppsCitrixPlugin=On''' must exist and

Following directory '''/var/log/apps/myAppsPlugin/''' must also exist for the log files with write permission for everyone (drwxrwxrwx)

====Audio Quality issues (e.g. choppy audio)====
If you run into audio quality when using myapps on Linux, the following configuration is recommended:

* Use Pipewire as the audio server
* Set the system-wide sample rate (default 44.1 kHz) to 48 kHz, since most USB headsets (e.g. Jabra) operate at 48 kHz.

You need to apply settings on OS level, since the audio backend and sample rate are operating system settings and cannot be controlled by the application.

You can check the Active audio server and sample rate with the following command:

<code>pactl info</code>

Based on your language-settings you will get a different output.
But you want to look for something like "Server Name" and "Default-Sample-Specification".

The expected results are (Language set to English):

Server Name: pulseaudio

Default Sample Specification: s16le 2ch 48000Hz

If you use pipewire you will get something like this:

Server Name: PulseAudio (on PipeWire 1.4.2)

Default Sample Specification: float32le 2ch 48000Hz

=== Troubleshooting MacOS ===

'''Citrix Workspace App must be installed before the myAppsPlugin'''

In /Library/Application Support/Citrix/PlugIns

must exist myAppsCitrixPlugin.plugin -> /Application/myappsPlugin.app/Contents/PlugIns/myapps_citrix_plugin.plugin

under:

/Users/.../Library/Application Support/Citrix Receiver

there is a file called Modules. Inside this file the myApps Plugin is included:

- VirtualDriver entry must contain myAppsCitrixPlugin

- a line with myAppsCitrixPlugin=On must exist

- and another line with [myAppsCitrixPlugin] too

both things are done during the installation. In case something is not working must check that the link to the plugin exists and that the modules file contains these entries.

And under /Users/.../Library/Containers/com.innovaphone.myapps-plugin-14r2/Data/Documents a log file is created: myAppsPlugin.txt

=== Troubleshooting Citrix ===
A Virtual Channel Policy must be added to the Registry at the '''Citrix Server''':

Create '''VCPolicies''' folder under '''HKLM/Software/Policies/Citrix''' if it does not exist.

Create '''VCPolicies''' folder under '''HKLM/Software/WOW6432Node/Policies/Citrix''' if it does not exist.

Create a REG_MULTI_SZ entry with the name '''VirtualChannelWhiteList'''. This entry must contain as value: '''INNOHDX,C:\Program Files (x86)\innovaphone\myApps\myApps.exe'''

=== Troubleshooting RTP Stream ===

You can analyze the RTP stream with the switch "--record-rtp-stream"

* RTP reception after Echo Canceller and JitterBuffer
* Audio from microphone and send to RTP

You have to start the myApps client as follows: myApps.exe --record-rtp-stream

After the call, you can find the audio files in the folder: C:\Users\...\AppData\Local\innovaphone\myApps

Tool to listen to the RTP stream: Audacity

Go to: File / Import / Raw Data and open the Folder with the Rtp stream and select the file.

For RTP-Send and RTP-Recv Data, use the Audio Codec G711 -> A-Law and 8000

For the Wave-in (out) Data Use Signed 16-bit PCM and 8000 Abtastrate

==Hints==
If all users would like to start with a clean, fresh appproxy (eg to be sure that all cached data is re-retrieved), you can add the appproxy directory to the 'Ausschlussliste - Verzeichnisse'/'Exclusion list - directories' for each user:
* Open Citrix Studio
* Open Policies in the left navigation pane (Configuration/Policies)
* Edit or Create an exisiting policy (Upon create you can filter for 'profile' or 'exclusion'). Search for 'Profile Management/Exclusion list – directories' or 'ProfilverwaltungAusschlussliste Verzeichnisse'.
* Select Exclusion list - directories and click Add.
* Add 'AppData\Local\innovaphone\myApps\appproxy'

== Related Articles ==

* https://wiki.innovaphone.com/index.php?title=Reference14r2:Concept_myApps
* https://wiki.innovaphone.com/index.php?title=Reference14r2:Concept_App_SoftphoneApp

Howto:Ilink-crm-ext- ilink - Partner App

2026-08-05T12:44:53Z

Vsc: /* Licensing */

[[Image:ilink.jpg|200px|right|/Ilink.jpg|ilink.jpg/]]

==Product Name==


ilink Kommunikationssysteme GmbH [https://www.ilink.de/ilink-crmext/info.html ilink CRM Extensions]

==Certification Status==

{{Template:Compat_Status_referral_product_new|type=App}}

This App has been listed March 2023.

==Category==

[[Category:Partner Apps|{{PAGENAME}}]]
{{Category:3rdParty App Development}}
[[Category:3rdParty App Development|{{PAGENAME}}]]

==Vendor==



[[Image:ilink.jpg|150px|/Ilink.jpg|ilink.jpg/]]





[https://www.ilink.de/ ilink - About us]

==Description==






ilink CRM Extensions is a slim and flexible Windows application for inbound caller recognition and for dialing phone numbers through company phones with a click. And it works in home offices, too!

A popup window displays information like caller name, company, location, and phone number for inbound calls. This information is directly taken from your CRM system, from your address book, or from public telephone directories. Using the „Open Contact“ button, the user directly opens the corresponding contact view of his CRM client. Dial with single click from many CRM systems, or use the hotkey to dial from almost all Windows applications.

Supported CRM systems include:Act!, Datev, Goldmine Premium Edition, HCL Connections, HCL Notes, HubSpot, Maximizer CRM, Microsoft Dynamics CRM, Microsoft Outlook + Exchange Public Folder, Netsuite, ODBC databases - customizing through SQL commands, Sage CRM, Salesforce.com, SAP, Sugar CRM, Tigerpaw CRM, vCard / LDAP.

Supported online telephone books: telefonbuch.de (Germany), Das Örtliche (Germany), local.ch (Switzerland), search.ch (Switzerland), herold.at (Austria), whitepages.com (USA).


[https://www.ilink.de/de/products/ilink_crm_extensions/innovaphone/index.html - About this application]

==Licensing==



[https://www.innovaphone.com/en/services/licenses/partner-app-licenses.html?app=ilink%20crm%20extensions See ilink crm-ext license conditions]

==Versions==


===Compatible innovaphone firmware versions===

* innovaphone V13r2 or higher
===Application versions used for interop testing===


* ilink ilink-crm-ext 1008 final, 27/03/2023

* innovaphone V13r2, 15r1sr3

==Configuration==










[https://www.ilink.de/de/products/ilink_crm_extensions/innovaphone/install-configuration.html See ilink configuration (German) guide for innovaphone myApps] 
[https://www.ilink.de/en/products/ilink_crm_extensions/innovaphone/install-configuration.html See ilink configuration (English) guide for innovaphone myApps]

Please note: The name of the PBX object must be spelled exactly: ilink-crmext
Using another name leads to an error message "ilink-crmext" in the log files.

==Contact==




{|
| ilink Kommunikationssysteme GmbH
|-
| Tel: +49 30 28526 1254
|-
|Mob: +49 171 6407377
|-
| Mail: [mailto:info@ilink.de info@ilink.de]
|}
Open Q&A and product demo and discussions: Every Wednesday at 10:00 here: https://sametime.dnug.de/meeting/CRMIntegrationen

For any questions please refer to [https://www.ilink.de/en/products/ilink_crm_extensions/innovaphone/support.html our contact page].

Howto:Ilink-crm-ext- ilink - Partner App

2026-08-05T11:27:52Z

Vsc: /* Licensing */

[[Image:ilink.jpg|200px|right|/Ilink.jpg|ilink.jpg/]]

==Product Name==


ilink Kommunikationssysteme GmbH [https://www.ilink.de/ilink-crmext/info.html ilink CRM Extensions]

==Certification Status==

{{Template:Compat_Status_referral_product_new|type=App}}

This App has been listed March 2023.

==Category==

[[Category:Partner Apps|{{PAGENAME}}]]
{{Category:3rdParty App Development}}
[[Category:3rdParty App Development|{{PAGENAME}}]]

==Vendor==



[[Image:ilink.jpg|150px|/Ilink.jpg|ilink.jpg/]]





[https://www.ilink.de/ ilink - About us]

==Description==






ilink CRM Extensions is a slim and flexible Windows application for inbound caller recognition and for dialing phone numbers through company phones with a click. And it works in home offices, too!

A popup window displays information like caller name, company, location, and phone number for inbound calls. This information is directly taken from your CRM system, from your address book, or from public telephone directories. Using the „Open Contact“ button, the user directly opens the corresponding contact view of his CRM client. Dial with single click from many CRM systems, or use the hotkey to dial from almost all Windows applications.

Supported CRM systems include:Act!, Datev, Goldmine Premium Edition, HCL Connections, HCL Notes, HubSpot, Maximizer CRM, Microsoft Dynamics CRM, Microsoft Outlook + Exchange Public Folder, Netsuite, ODBC databases - customizing through SQL commands, Sage CRM, Salesforce.com, SAP, Sugar CRM, Tigerpaw CRM, vCard / LDAP.

Supported online telephone books: telefonbuch.de (Germany), Das Örtliche (Germany), local.ch (Switzerland), search.ch (Switzerland), herold.at (Austria), whitepages.com (USA).


[https://www.ilink.de/de/products/ilink_crm_extensions/innovaphone/index.html - About this application]

==Licensing==



[https://www.innovaphone.com/de/services/lizenzen/partner-app-lizenzen.html?app=ilink%20crm%20extensions See ilink crm-ext license conditions]

==Versions==


===Compatible innovaphone firmware versions===

* innovaphone V13r2 or higher
===Application versions used for interop testing===


* ilink ilink-crm-ext 1008 final, 27/03/2023

* innovaphone V13r2, 15r1sr3

==Configuration==










[https://www.ilink.de/de/products/ilink_crm_extensions/innovaphone/install-configuration.html See ilink configuration (German) guide for innovaphone myApps] 
[https://www.ilink.de/en/products/ilink_crm_extensions/innovaphone/install-configuration.html See ilink configuration (English) guide for innovaphone myApps]

Please note: The name of the PBX object must be spelled exactly: ilink-crmext
Using another name leads to an error message "ilink-crmext" in the log files.

==Contact==




{|
| ilink Kommunikationssysteme GmbH
|-
| Tel: +49 30 28526 1254
|-
|Mob: +49 171 6407377
|-
| Mail: [mailto:info@ilink.de info@ilink.de]
|}
Open Q&A and product demo and discussions: Every Wednesday at 10:00 here: https://sametime.dnug.de/meeting/CRMIntegrationen

For any questions please refer to [https://www.ilink.de/en/products/ilink_crm_extensions/innovaphone/support.html our contact page].

Howto:Ilink-crm-ext- ilink - Partner App

2026-08-05T11:25:53Z

Vsc:

[[Image:ilink.jpg|200px|right|/Ilink.jpg|ilink.jpg/]]

==Product Name==


ilink Kommunikationssysteme GmbH [https://www.ilink.de/ilink-crmext/info.html ilink CRM Extensions]

==Certification Status==

{{Template:Compat_Status_referral_product_new|type=App}}

This App has been listed March 2023.

==Category==

[[Category:Partner Apps|{{PAGENAME}}]]
{{Category:3rdParty App Development}}
[[Category:3rdParty App Development|{{PAGENAME}}]]

==Vendor==



[[Image:ilink.jpg|150px|/Ilink.jpg|ilink.jpg/]]





[https://www.ilink.de/ ilink - About us]

==Description==






ilink CRM Extensions is a slim and flexible Windows application for inbound caller recognition and for dialing phone numbers through company phones with a click. And it works in home offices, too!

A popup window displays information like caller name, company, location, and phone number for inbound calls. This information is directly taken from your CRM system, from your address book, or from public telephone directories. Using the „Open Contact“ button, the user directly opens the corresponding contact view of his CRM client. Dial with single click from many CRM systems, or use the hotkey to dial from almost all Windows applications.

Supported CRM systems include:Act!, Datev, Goldmine Premium Edition, HCL Connections, HCL Notes, HubSpot, Maximizer CRM, Microsoft Dynamics CRM, Microsoft Outlook + Exchange Public Folder, Netsuite, ODBC databases - customizing through SQL commands, Sage CRM, Salesforce.com, SAP, Sugar CRM, Tigerpaw CRM, vCard / LDAP.

Supported online telephone books: telefonbuch.de (Germany), Das Örtliche (Germany), local.ch (Switzerland), search.ch (Switzerland), herold.at (Austria), whitepages.com (USA).


[https://www.ilink.de/de/products/ilink_crm_extensions/innovaphone/index.html - About this application]

==Licensing==



[https://www.ilink.de/de/products/ilink_crm_extensions/innovaphone/license.html See ilink crm-ext license conditions]

==Versions==


===Compatible innovaphone firmware versions===

* innovaphone V13r2 or higher
===Application versions used for interop testing===


* ilink ilink-crm-ext 1008 final, 27/03/2023

* innovaphone V13r2, 15r1sr3

==Configuration==










[https://www.ilink.de/de/products/ilink_crm_extensions/innovaphone/install-configuration.html See ilink configuration (German) guide for innovaphone myApps] 
[https://www.ilink.de/en/products/ilink_crm_extensions/innovaphone/install-configuration.html See ilink configuration (English) guide for innovaphone myApps]

Please note: The name of the PBX object must be spelled exactly: ilink-crmext
Using another name leads to an error message "ilink-crmext" in the log files.

==Contact==




{|
| ilink Kommunikationssysteme GmbH
|-
| Tel: +49 30 28526 1254
|-
|Mob: +49 171 6407377
|-
| Mail: [mailto:info@ilink.de info@ilink.de]
|}
Open Q&A and product demo and discussions: Every Wednesday at 10:00 here: https://sametime.dnug.de/meeting/CRMIntegrationen

For any questions please refer to [https://www.ilink.de/en/products/ilink_crm_extensions/innovaphone/support.html our contact page].

Howto:ECOMS-KI - DATUS AG - 3rd Party Product

2026-08-04T07:17:11Z

Vsc: /* Description */

[[Image:Datus_Company_Logo.png||200px|right]]

==Product Name==


DATUS AG [https://www.datus.com/kopie-von-ecoms-l%C3%B6sungen-f%C3%BCr-notruf ECOMS-KI]

==Certification Status==

{{Template:Compat_Status_referral_product_new}}
Testing of this product has been finalized July, 2026.

==Category==

{{Category:3rdParty Contact Center Applications}}
[[Category:Referral Product|{{PAGENAME}}]]
[[Category:3rdParty Contact Center Applications|{{PAGENAME}}]]

==Vendor==



[[Image:Datus_Company_Logo.png|150px|link=https://www.datus.com/]]

DATUS AG has been a specialist in customized IT solutions for more than 50 years and offers a broad portfolio of in-house developed products.

Our focus is on designing innovative, tailor-made communication solutions.

As a medium-sized company, we successfully deliver projects of all sizes using state-of-the-art technology – Made in Germany.

==Description==



[[Image:Datus_EcomsKI_Logo.png|link=https://www.datus.com/kopie-von-ecoms-l%C3%B6sungen-f%C3%BCr-notruf]]

ECOMS-KI is a modular platform that provides a flexible solution for integrating artificial intelligence into the innovaphone PBX.

Whether for real-time translation, transcription, call summarization, voicebot applications, or the optimization of workflows and business processes, ECOMS-KI enables a wide range of innovative use cases.

==Functions==


The system meets the highest data protection requirements and can be deployed either entirely on-premises or in a cloud environment.

Integration with the innovaphone PBX is established via a SIP trunk connection.

==Use Cases==

===Alternis Translation===
[[Image:Datus_Ecoms_Alternis.png]]

===Voicebot Application – Example Use Case: Medical Transport===
[[Image:Datus_Ecoms_Voicebot.png]]

===Workflow – Example Use Case: Standardized Emergency Call Interrogation===
[[Image:Datus_Ecoms_Workflow.png]]

==Version==



Product versions used for interop testing:


'''innovaphone PBX:'''
 innovaphone Virtual Appliance based on Proxmox 16r1sr2 [16.1.0910]

'''ECOMS-KI:'''
 Indali PBX: Release R11.0.7 (B48)

==Configuration==






===Overview===
[[Image:Datus_Ecoms_innovaphone.png]]

===Configuration of the innovaphone PBX===
====PBX Config====
[[Image:Datus_Ecoms_innovaphone_pbx_1.png]]
====PBX Objects====
[[Image:Datus_Ecoms_innovaphone_pbx_2.png]]
====SIP Interface====
[[Image:Datus_Ecoms_innovaphone_pbx_3.png]]

Alternatively, TCP can be selected as the transport protocol. In this case, both indali PBX VoIP accounts must also be configured to use TCP as the transport protocol. TLS is currently not supported.
====Gateway SIP CGPN and CDPN Modification====
[[Image:Datus_Ecoms_innovaphone_pbx_4.png]]
====Gateway Gatekeeper====
[[Image:Datus_Ecoms_innovaphone_pbx_7.png]]
====Gateway Routes====
[[Image:Datus_Ecoms_innovaphone_pbx_8.png]]

===Configuration of ECOMS-KI / indali PBX===
====Telephone System -> VoIP Accounts====
[[Image:Datus_Ecoms_indali_4.png]]
====VoIP Account -> From Innovaphone PBX====
[[Image:Datus_Ecoms_indali_5.png]]
====VoIP Account -> To Innovaphone PBX====
[[Image:Datus_Ecoms_indali_6.png]]
====Call Rules -> Incoming Calls====
[[Image:Datus_Ecoms_indali_7.png]] 
[[Image:Datus_Ecoms_indali_8.png]] 
[[Image:Datus_Ecoms_indali_9.png]]

==Summary==


The configuration described in this document establishes the connection between the innovaphone PBX and the indali PBX and provides the basis for integrating the ECOMS-KI ALTERNIS application into the audio stream of active telephone calls.

==Contact==



{|
| DATUS AG
|-
| Service & Support
|-
| Pascalstr. 12
|-
| 52076 Aachen Germany
|-
| Tel: [tel:00492408938243 +49 2408 9382-43]
|-
| Fax: +49 2408 9382-943
|-
| Mail: [mailto:dsc.hotline@datus.com dsc.hotline@datus.com]
|}

Howto:ECOMS-KI - DATUS AG - 3rd Party Product

2026-08-04T07:16:49Z

Vsc: /* Description */

[[Image:Datus_Company_Logo.png||200px|right]]

==Product Name==


DATUS AG [https://www.datus.com/kopie-von-ecoms-l%C3%B6sungen-f%C3%BCr-notruf ECOMS-KI]

==Certification Status==

{{Template:Compat_Status_referral_product_new}}
Testing of this product has been finalized July, 2026.

==Category==

{{Category:3rdParty Contact Center Applications}}
[[Category:Referral Product|{{PAGENAME}}]]
[[Category:3rdParty Contact Center Applications|{{PAGENAME}}]]

==Vendor==



[[Image:Datus_Company_Logo.png|150px|link=https://www.datus.com/]]

DATUS AG has been a specialist in customized IT solutions for more than 50 years and offers a broad portfolio of in-house developed products.

Our focus is on designing innovative, tailor-made communication solutions.

As a medium-sized company, we successfully deliver projects of all sizes using state-of-the-art technology – Made in Germany.

==Description==



[[Image:Datus_EcomsKI_Logo.png<link=https://www.datus.com/kopie-von-ecoms-l%C3%B6sungen-f%C3%BCr-notruf]]

ECOMS-KI is a modular platform that provides a flexible solution for integrating artificial intelligence into the innovaphone PBX.

Whether for real-time translation, transcription, call summarization, voicebot applications, or the optimization of workflows and business processes, ECOMS-KI enables a wide range of innovative use cases.

==Functions==


The system meets the highest data protection requirements and can be deployed either entirely on-premises or in a cloud environment.

Integration with the innovaphone PBX is established via a SIP trunk connection.

==Use Cases==

===Alternis Translation===
[[Image:Datus_Ecoms_Alternis.png]]

===Voicebot Application – Example Use Case: Medical Transport===
[[Image:Datus_Ecoms_Voicebot.png]]

===Workflow – Example Use Case: Standardized Emergency Call Interrogation===
[[Image:Datus_Ecoms_Workflow.png]]

==Version==



Product versions used for interop testing:


'''innovaphone PBX:'''
 innovaphone Virtual Appliance based on Proxmox 16r1sr2 [16.1.0910]

'''ECOMS-KI:'''
 Indali PBX: Release R11.0.7 (B48)

==Configuration==






===Overview===
[[Image:Datus_Ecoms_innovaphone.png]]

===Configuration of the innovaphone PBX===
====PBX Config====
[[Image:Datus_Ecoms_innovaphone_pbx_1.png]]
====PBX Objects====
[[Image:Datus_Ecoms_innovaphone_pbx_2.png]]
====SIP Interface====
[[Image:Datus_Ecoms_innovaphone_pbx_3.png]]

Alternatively, TCP can be selected as the transport protocol. In this case, both indali PBX VoIP accounts must also be configured to use TCP as the transport protocol. TLS is currently not supported.
====Gateway SIP CGPN and CDPN Modification====
[[Image:Datus_Ecoms_innovaphone_pbx_4.png]]
====Gateway Gatekeeper====
[[Image:Datus_Ecoms_innovaphone_pbx_7.png]]
====Gateway Routes====
[[Image:Datus_Ecoms_innovaphone_pbx_8.png]]

===Configuration of ECOMS-KI / indali PBX===
====Telephone System -> VoIP Accounts====
[[Image:Datus_Ecoms_indali_4.png]]
====VoIP Account -> From Innovaphone PBX====
[[Image:Datus_Ecoms_indali_5.png]]
====VoIP Account -> To Innovaphone PBX====
[[Image:Datus_Ecoms_indali_6.png]]
====Call Rules -> Incoming Calls====
[[Image:Datus_Ecoms_indali_7.png]] 
[[Image:Datus_Ecoms_indali_8.png]] 
[[Image:Datus_Ecoms_indali_9.png]]

==Summary==


The configuration described in this document establishes the connection between the innovaphone PBX and the indali PBX and provides the basis for integrating the ECOMS-KI ALTERNIS application into the audio stream of active telephone calls.

==Contact==



{|
| DATUS AG
|-
| Service & Support
|-
| Pascalstr. 12
|-
| 52076 Aachen Germany
|-
| Tel: [tel:00492408938243 +49 2408 9382-43]
|-
| Fax: +49 2408 9382-943
|-
| Mail: [mailto:dsc.hotline@datus.com dsc.hotline@datus.com]
|}

Howto:ECOMS-KI - DATUS AG - 3rd Party Product

2026-08-04T07:16:17Z

Vsc: /* Vendor */

[[Image:Datus_Company_Logo.png||200px|right]]

==Product Name==


DATUS AG [https://www.datus.com/kopie-von-ecoms-l%C3%B6sungen-f%C3%BCr-notruf ECOMS-KI]

==Certification Status==

{{Template:Compat_Status_referral_product_new}}
Testing of this product has been finalized July, 2026.

==Category==

{{Category:3rdParty Contact Center Applications}}
[[Category:Referral Product|{{PAGENAME}}]]
[[Category:3rdParty Contact Center Applications|{{PAGENAME}}]]

==Vendor==



[[Image:Datus_Company_Logo.png|150px|link=https://www.datus.com/]]

DATUS AG has been a specialist in customized IT solutions for more than 50 years and offers a broad portfolio of in-house developed products.

Our focus is on designing innovative, tailor-made communication solutions.

As a medium-sized company, we successfully deliver projects of all sizes using state-of-the-art technology – Made in Germany.

==Description==



[[Image:Datus_EcomsKI_Logo.png]]

ECOMS-KI is a modular platform that provides a flexible solution for integrating artificial intelligence into the innovaphone PBX.

Whether for real-time translation, transcription, call summarization, voicebot applications, or the optimization of workflows and business processes, ECOMS-KI enables a wide range of innovative use cases.

==Functions==


The system meets the highest data protection requirements and can be deployed either entirely on-premises or in a cloud environment.

Integration with the innovaphone PBX is established via a SIP trunk connection.

==Use Cases==

===Alternis Translation===
[[Image:Datus_Ecoms_Alternis.png]]

===Voicebot Application – Example Use Case: Medical Transport===
[[Image:Datus_Ecoms_Voicebot.png]]

===Workflow – Example Use Case: Standardized Emergency Call Interrogation===
[[Image:Datus_Ecoms_Workflow.png]]

==Version==



Product versions used for interop testing:


'''innovaphone PBX:'''
 innovaphone Virtual Appliance based on Proxmox 16r1sr2 [16.1.0910]

'''ECOMS-KI:'''
 Indali PBX: Release R11.0.7 (B48)

==Configuration==






===Overview===
[[Image:Datus_Ecoms_innovaphone.png]]

===Configuration of the innovaphone PBX===
====PBX Config====
[[Image:Datus_Ecoms_innovaphone_pbx_1.png]]
====PBX Objects====
[[Image:Datus_Ecoms_innovaphone_pbx_2.png]]
====SIP Interface====
[[Image:Datus_Ecoms_innovaphone_pbx_3.png]]

Alternatively, TCP can be selected as the transport protocol. In this case, both indali PBX VoIP accounts must also be configured to use TCP as the transport protocol. TLS is currently not supported.
====Gateway SIP CGPN and CDPN Modification====
[[Image:Datus_Ecoms_innovaphone_pbx_4.png]]
====Gateway Gatekeeper====
[[Image:Datus_Ecoms_innovaphone_pbx_7.png]]
====Gateway Routes====
[[Image:Datus_Ecoms_innovaphone_pbx_8.png]]

===Configuration of ECOMS-KI / indali PBX===
====Telephone System -> VoIP Accounts====
[[Image:Datus_Ecoms_indali_4.png]]
====VoIP Account -> From Innovaphone PBX====
[[Image:Datus_Ecoms_indali_5.png]]
====VoIP Account -> To Innovaphone PBX====
[[Image:Datus_Ecoms_indali_6.png]]
====Call Rules -> Incoming Calls====
[[Image:Datus_Ecoms_indali_7.png]] 
[[Image:Datus_Ecoms_indali_8.png]] 
[[Image:Datus_Ecoms_indali_9.png]]

==Summary==


The configuration described in this document establishes the connection between the innovaphone PBX and the indali PBX and provides the basis for integrating the ECOMS-KI ALTERNIS application into the audio stream of active telephone calls.

==Contact==



{|
| DATUS AG
|-
| Service & Support
|-
| Pascalstr. 12
|-
| 52076 Aachen Germany
|-
| Tel: [tel:00492408938243 +49 2408 9382-43]
|-
| Fax: +49 2408 9382-943
|-
| Mail: [mailto:dsc.hotline@datus.com dsc.hotline@datus.com]
|}

Howto:ECOMS-KI - DATUS AG - 3rd Party Product

2026-08-04T06:49:06Z

Vsc: Created page with " right ==Product Name==   DATUS AG [https://www.datus.com/kopie-von-ecoms-l%C3%B6sungen-f%C3%BCr-notruf ECOMS-KI] ==Certification Status== <!-- do not remove comment. Will be done by innovaphone upon document che..."

[[Image:Datus_Company_Logo.png||200px|right]]

==Product Name==


DATUS AG [https://www.datus.com/kopie-von-ecoms-l%C3%B6sungen-f%C3%BCr-notruf ECOMS-KI]

==Certification Status==

{{Template:Compat_Status_referral_product_new}}
Testing of this product has been finalized July, 2026.

==Category==

{{Category:3rdParty Contact Center Applications}}
[[Category:Referral Product|{{PAGENAME}}]]
[[Category:3rdParty Contact Center Applications|{{PAGENAME}}]]

==Vendor==



[[Image:Datus_Company_Logo.png|150px]]

DATUS AG has been a specialist in customized IT solutions for more than 50 years and offers a broad portfolio of in-house developed products.

Our focus is on designing innovative, tailor-made communication solutions.

As a medium-sized company, we successfully deliver projects of all sizes using state-of-the-art technology – Made in Germany.

==Description==



[[Image:Datus_EcomsKI_Logo.png]]

ECOMS-KI is a modular platform that provides a flexible solution for integrating artificial intelligence into the innovaphone PBX.

Whether for real-time translation, transcription, call summarization, voicebot applications, or the optimization of workflows and business processes, ECOMS-KI enables a wide range of innovative use cases.

==Functions==


The system meets the highest data protection requirements and can be deployed either entirely on-premises or in a cloud environment.

Integration with the innovaphone PBX is established via a SIP trunk connection.

==Use Cases==

===Alternis Translation===
[[Image:Datus_Ecoms_Alternis.png]]

===Voicebot Application – Example Use Case: Medical Transport===
[[Image:Datus_Ecoms_Voicebot.png]]

===Workflow – Example Use Case: Standardized Emergency Call Interrogation===
[[Image:Datus_Ecoms_Workflow.png]]

==Version==



Product versions used for interop testing:


'''innovaphone PBX:'''
 innovaphone Virtual Appliance based on Proxmox 16r1sr2 [16.1.0910]

'''ECOMS-KI:'''
 Indali PBX: Release R11.0.7 (B48)

==Configuration==






===Overview===
[[Image:Datus_Ecoms_innovaphone.png]]

===Configuration of the innovaphone PBX===
====PBX Config====
[[Image:Datus_Ecoms_innovaphone_pbx_1.png]]
====PBX Objects====
[[Image:Datus_Ecoms_innovaphone_pbx_2.png]]
====SIP Interface====
[[Image:Datus_Ecoms_innovaphone_pbx_3.png]]

Alternatively, TCP can be selected as the transport protocol. In this case, both indali PBX VoIP accounts must also be configured to use TCP as the transport protocol. TLS is currently not supported.
====Gateway SIP CGPN and CDPN Modification====
[[Image:Datus_Ecoms_innovaphone_pbx_4.png]]
====Gateway Gatekeeper====
[[Image:Datus_Ecoms_innovaphone_pbx_7.png]]
====Gateway Routes====
[[Image:Datus_Ecoms_innovaphone_pbx_8.png]]

===Configuration of ECOMS-KI / indali PBX===
====Telephone System -> VoIP Accounts====
[[Image:Datus_Ecoms_indali_4.png]]
====VoIP Account -> From Innovaphone PBX====
[[Image:Datus_Ecoms_indali_5.png]]
====VoIP Account -> To Innovaphone PBX====
[[Image:Datus_Ecoms_indali_6.png]]
====Call Rules -> Incoming Calls====
[[Image:Datus_Ecoms_indali_7.png]] 
[[Image:Datus_Ecoms_indali_8.png]] 
[[Image:Datus_Ecoms_indali_9.png]]

==Summary==


The configuration described in this document establishes the connection between the innovaphone PBX and the indali PBX and provides the basis for integrating the ECOMS-KI ALTERNIS application into the audio stream of active telephone calls.

==Contact==



{|
| DATUS AG
|-
| Service & Support
|-
| Pascalstr. 12
|-
| 52076 Aachen Germany
|-
| Tel: [tel:00492408938243 +49 2408 9382-43]
|-
| Fax: +49 2408 9382-943
|-
| Mail: [mailto:dsc.hotline@datus.com dsc.hotline@datus.com]
|}

File:Datus Ecoms indali 9.png

2026-08-04T06:45:26Z

Vsc:

File:Datus Ecoms indali 8.png

2026-08-04T06:45:16Z

Vsc: