innovaphone wiki - User contributions [en]

Reference14r2:General/Admin

2026-08-25T06:31:59Z

Vsc: /* Help URL */

Parameters for the Administration access of the device are configured here.

==Basic parameters==
===Device Name===
The name of the device. This name is displayed in the browser as a title. It is also added to the product id sent with outgoing registrations. This way it is displayed e.g. on the registrations page of the PBX.
===User/Password===
The administrator account. This account can be used for telnet access (if configured) and all password protected pages of the web user interface. By default all pages except Administration/General/Info are password protected. The web server of the device can be configured to protect all pages. The password has to be entered twice.

The password cannot be left empty. If an empty password is entered, the password won't be changed.
The length of the password is limited to 63 characters.

===Automatic Logout after (min)===
===Require Certificate===
If mutual TLS is used to login, the device does not usually check that the trusted client certificate is issued to the user who is trying to login.

For enhanced security the device can require that a trusted client certificate issued to the user is available to be able to login.

The following conditions must be met before enabling this feature:
* A trusted client certificate with the associated private key must be available in the web browser’s certificate store.
* The Subject Alternative Name in the certificate must correspond to the User ID entered at login.
* The trusted client certificate issued to the user or the CA certificate that signed client certificate must be added to the trust list in the device.
* Mutual TLS authentication must be enabled.
IMPORTANT: Make sure that the correct certificate is installed before requiring a user certificate.
If the correct certificate is not available, and mutual TLS authentication is enabled, it is not possible to access the device in any other way.
===Disable Native Authentication===
The use of http authentication can be disabled and the form-based login is used all the time when user authentication is required.
Native authentication is disabled by default.

== Additional Administrator Accounts ==

Additional user accounts. These user accounts can have viewer or full administrator privileges. The length of the password is limited to 15 characters.

== Limit sessions ==
Limit concurrent web-ui sessions in total or per user
== Help URL ==

The URL to access the online help. By default an URL of <nowiki>"http://wiki.innovaphone.com/index.php?Title=Reference<major firmware version number>:<page name>"</nowiki> is used. This links to online help pages in the Reference namespace of the innovaphone wiki.

For example on a V9 device configure following Help URL to link to the local wikitogo installation:

<code>http://192.168.0.100:8081/index.php?Title=Reference9:</code>

== Delegated Authentication ==
In v8 devices can delegate authentication of administrative users to an authentication server using Kerberos. To enable remote user authentication the device has to join the realm of an innovaphone Kerberos server. Delegated authentication can only be used with HTTPS.

=== Join realm ===

The server location of the realm has to be configured, first (see section "Authentication Servers").

Click "Join realm" and specify the username and password of an administrator in the target realm to add the device to the remote host database. This works only with innovaphone servers. If you want to authenticate users from a third-party server setup cross-realm authentication.

=== Leave realm ===

An administrator username and password from the realm is needed to deregister from the realm and remove the device from the remote host database. If the server does not exist any longer the registration can be deleted manually.

=== Default user realm ===

This is the default Kerberos realm that shall be used if users log-in without specifying a realm.

\user -> example.com\user
user@ -> user@example.com

If no default user realm is configured, the Kerberos realm of the box is used. So the parameter is only needed if users and devices are members of different realms.

=== Disable local authentication ===

If this option is selected only users from the Kerberos server are accepted. Logins using local administrator accounts will be rejected. Activating this feature together with [[Reference9:Phone/Protect|"Protect configuration at phone"]] option will disable you to make any changes on the phone.

== Authentication Servers ==

The addresses of Kerberos servers have to be configured locally on each host or client device.

If there is no server configured for a realm, the device will try to locate it using DNS. The Kerberos server is looked up in the following SRV record.

_kerberos._udp.REALM ''(e.g. _kerberos._udp.example.com)''

Normally this should work for Windows servers in the LAN.

The Kerberos admin service for joining and leaving realms is located using:

_kpasswd._udp.REALM ''(e.g. _kpasswd._udp.example.com)''

== Debugging ==
If you have trouble you may want to set <code>config add CMD0 /kerberos-trace</code> (and activate it) on the device you try to log-in to. On the kerberos server (if it is an innovaphone box), you can set the ''Kerberos Server'' check marks in ''Maintenance/Diagnostics/Logging'' and ''Maintenance/Diagnostics/Tracing''. Also keep in mind that kerberos-based authentication is '''only available with HTTPS'''.

Reference16r1:PBX/Objects

2026-08-18T07:10:37Z

Vsc: /* License */

This page is used for the administration of PBX objects. A list of already configured objects can be displayed filtered by various criteria. New objects can be created and existing objects can be changed or deleted.

== Display of existing Objects ==
By pressing the show link, existing objects are displayed. With the filter field (the input field left to the show link) the displayed objects are limited to those matching the filter. The filter is first applied to the 'Long Name' of the objects meaning a non case sensitive head match of the filter and the 'Long Name' is performed. If there are matching objects these are displayed.

If there are no matching objects the filter is used to match the Number of the objects including any node prefixes. This way objects of a given node with all sub-nodes can be displayed by entering the prefix of a node here.

Below the filter input field is a list of all PBXs in the system (at least the part of the system which is replicated to this device). By clicking on a PBX in the list only the objects which are assigned to this PBX are displayed and the groups configured on this PBX are displayed as well. By clicking on a group only the members of this group are displayed.

=== List of Objects ===

On the right side the list of objects is displayed. The most important configuration properties are displayed in this list to provide an overview. To view the full configuration of a given object it must be opened for editing by clicking the Long Name. The list can be sorted by clicking the table headers.

The Number of the objects in this list is not the number configured in the object but it is expanded with the prefixes of the nodes in which the object is configured.

Group memberships and Call Forwarding for an object are changed by clicking on the 'Groups' or 'CF*' link of the object. A '*' appended to a group displayed in this list means that the active flag of this group membership is set.
A '!' appended to a group displayed in this list means that group indications are configured for this group.

Fork number appended by a '*' indicates a mobility enabled user. In case the number is displayed in grey, the user consumes no mobility license on local PBX (e.g. because the user registers on other PBX).

The last column are the IP addresses of registered endpoints for a given object. If the physical location of the endpoint is not the same as the PBX, the physical location is indicated by @<physical-location> added to the IP address. A '*' appended to this field means that this is an password authenticated registration.
Registrations which are because of a standby situation, which means they are not at the PBX for which they are configured, are marked with a special colour (by default this is red).

=== New Objects ===

New objects are created by selecting the type of object in the drop down list and clicking the new link. If the list of displayed objects is limited to a PBX/Group (see above), the PBX property of the new object is preset accordingly and the group membership is added to the object.

== Object Types ==

There are different types of objects for different purposes available

;[[{{NAMESPACE}}:PBX/Objects/User|User]]: A normal User
;[[{{NAMESPACE}}:PBX/Objects/ap|AP]]: Used to enable pbx connection to Application Platform
;[[{{NAMESPACE}}:PBX/Objects/App|App]]: Create a reference to an innovaphone App that can be used in myApps
;[[{{NAMESPACE}}:PBX/Objects/Call Broadcast Conference|BC Conference]]: A Conference which automatically calls other users
;[[{{NAMESPACE}}:PBX/Objects/Boolean|Boolean]]: Used to enable Call Forwards an other things based on time/date or by calling to this object
;[[{{NAMESPACE}}:PBX/Objects/Call Broadcast|Call Broadcast]]: Forward a call to a group
;[[{{NAMESPACE}}:PBX/Objects/Conference|Conference]]: Used to create a conference
;[[{{NAMESPACE}}:PBX/Objects/Config Template|Config Template]]: Config which can be applied to other objects
;[[{{NAMESPACE}}:PBX/Objects/DECT System|DECT System]]: Defines a DECT system
;[[{{NAMESPACE}}:PBX/Objects/Directory Search|Directory Search]]: LDAP lookup based on number dialed
;[[{{NAMESPACE}}:PBX/Objects/DTMF Features|DTMF Features]]: Feature control for simple endpoints
;[[{{NAMESPACE}}:PBX/Objects/Executive|Executive]]: Executive in a executive/secretary configuration
;[[{{NAMESPACE}}:PBX/Objects/External UC|External UC]]: To forward presence subscriptions to external presence server
;[[{{NAMESPACE}}:PBX/Objects/Fax|Fax]]: Defines a fax service
;[[{{NAMESPACE}}:PBX/Objects/Gateway|Gateway]]: For registration of gateways
;[[{{NAMESPACE}}:PBX/Objects/ICP|ICP]]: Integration with ICP system
;[[{{NAMESPACE}}:PBX/Objects/MCast Announce|MCast Announce]]: Calls endpoints and forwards media as IP multicast
;[[{{NAMESPACE}}:PBX/Objects/Message Waiting|Message Waiting]]: Message Waiting for external Systems
;[[{{NAMESPACE}}:PBX/Objects/Messages|Messages]]: used to connect messaging service
;[[{{NAMESPACE}}:PBX/Objects/Mobility|Mobility]]: Mobile Integration
;[[{{NAMESPACE}}:PBX/Objects/Node|Node]]: Numbering Node
;[[{{NAMESPACE}}:PBX/Objects/Number Map|Number Map]]: Maps to other number
;[[{{NAMESPACE}}:PBX/Objects/PBX|PBX]]: To register slave PBX
;[[{{NAMESPACE}}:PBX/Objects/Push|Push]]: Defines a push service
;[[{{NAMESPACE}}:PBX/Objects/Directory Search|Quick Dial]]: Allows Quickdial based on external LDAP Directory
;[[{{NAMESPACE}}:PBX/Objects/Session Border|Session Border]]: Allows proxy registrations to other PBX
;[[{{NAMESPACE}}:PBX/Objects/Settings|Settings]]: control dynamic group memberships via myPBX client
;[[{{NAMESPACE}}:PBX/Objects/Trunk Line|Trunk Line]]: To register a trunk line
;[[{{NAMESPACE}}:PBX/Objects/Voicemail|Voicemail]]: Defines a voicemail service
;[[{{NAMESPACE}}:PBX/Objects/Waiting Queue|Waiting Queue]]: Define a waiting queue

== General Object Properties ==

Some configuration properties are specific to the type of object, some are common to all objects. Not each object type supports all general configuration properties.

;Description: Any text which can be used to describe the objects. Nothing is done with this text on the PBX.

;Hide from LDAP: When this check-mark is set, this object is available with a read-only LDAP access, which means it does not show up in the PBX phonebook on the phones.

;New Account: This checkmark can be set, adding a new User Object after deleting a User Object with the same Name, to that this is a new user and old information should not be reconnected to this user. Without this checkmark set, the name is used to connect the new User Object to the old information. This is mainly useful for information stored in Apps. Not every App does support this feature altready. It is supported by Connect and Chat, so when adding a user the setting of this checkmark means, that this is a new user and the old messages in Chat or Connect from a user with the same name are not visible for this user anymore.

;Long Name: This name is used to identify the object in the database and for display purposes. The long name must be unique throughout the system. For practical reasons, you should limit it to ''20 - extension length'' characters.

;Name
:The name of the object. This name is used for H.323 and SIP signalling (like a call number) and must be unique throughout the system.
:In order for the name to be handled correctly in all protocols, a few rules should be followed regarding the characters used.
:# The name must not start with a "." dot (See [[{{NAMESPACE}}:Concept Group Pickup across PBXs|Concept Group Pickup across PBXs]] for more details on using a dot.)
:# The character "@" must not be used (It is used as separator for E-Mail-Adresses)
:# The character "?" is a specially reserved character to append arguments, which can be used when a call is sent. (See [[{{NAMESPACE}}:PBX/Objects/Trunk_Line| Name as Number]] for more details on using a ?-sign.)
:# It is best to use only characters that are also used in e-mail addresses (before the @ sign). So "a-z0-9-_" in lower case letters.

:Note: Clients ''cannot'' use the ''Name'' and ''Number'' property as registration name without adding the ''name'' as hardware-id.
:Note: it is recommended to use the ''Name'' field for the e-mail address (everything prior the @) in combination with the ''Use as Domain'' flag at the ''System Name''.
:If the 'Name' is to be used as E-Mail address, the Check-mark on the ''E-Mail'' line besides the ''Name'' which is displayed there as well has to be set as well.

;Number
:The telephone number of the object. This is the number by which this object can be dialed within the same node. Which means it does not include any Node prefixes.
:Note: Clients ''cannot'' use the ''Name'' and ''Number'' property as registration name without adding the ''name'' as hardware-id.

;E-Mail: Additional E-Mail addresses for the user. Multiple addresses are separated by ';'. The 'Name' is used as E-Mail address as well together with the 'System Name' as domain. The E-Mail addresses are used to match users from other applications (e.g. Exchange, Fax Server) to PBX User Objects. The first E-Mail address is used as destination if E-Mails are to be sent to the User (e.g. received Fax). If the 'Name' shall be used as E-Mail destination, the check-mark besides the 'Name', which is duplicated to the E-Mail line should be set.

;Critical: If marked as critical the object can only be changed by administrators allowed to edit critical objects

;Password / Retype Password: If a registration password is allocated here, then it must be specified during registration, or otherwise the registration will fail. The length of the password is limited to 23 characters ASCII. Be aware when using Unicode characters like ü,ä,ö,ï,ë,é,ă,î,â,ș,ț,Ă,Î,Â,Ș,Ț,ă,î, due to the conversion from Unicode to ASCII the amount of available characters in your password will be decreased. You can use an online Unicode to ASCII converter to check if the password length is not exceeded.

;Node: The node that the object is assigned to. A Node hierarchy can be configured using Node Objects. Objects which are assigned to the same node can call each other with just the number. To call an object in a different node escapes and node prefixes have to be used. If no node is configured, the object is assigned to the node of the respective local PBX.

;PBX: The PBX that the object is assigned to. This PBX accepts registrations for the object. If no PBX is configured, the object is assigned to the respective local PBX.

;Reject ext. Calls: Calls from external sources to this object are rejected.

;Local: Marks an object as local. Local means that it can be called from endpoints physically located at the same PBX without prefixes even if the calling endpoint is in a different node. Where the endpoint is physical located is defined by the PBX the endpoint contacts first (it may be redirected to another PBX then for registration). If the object does not have a PBX configured the call is routed to the PBX where the calling endpoint is registered.
:''Note: Phones using this mechanism should use a Gatekeeper Identifier of <local-pbx>@<System Name> for registration. This way this mechanism works even if the registration happens without redirection. This can be the case if a secondary address is configured in case the local PBX is down. The registration will then be done without redirection an is not renewed when the local PBX comes up again.''

;Send Number: If an object does a call, the calling party number for this call will be replaced by the number given (if any). Used to hide an extension. If a prefix of '.' is configured, this number is interpreted as a number within the node of the object, if no prefix is configured the number is interpreted as a number within the root node.

;External: This is used together with the ''Name as Number'' Feature of a trunk object. If a ''Name as Number'' configuration is set, starting with '?' it is matched to this entry. If only '?' is configured it always matches. Any digit following the matching part is sent as CLI for calls out through the trunk object.

;Dial In: If this check-mark is set, the external CLI which is sent out on the trunk, can also be used to dial in from the trunk. In this case this CLI must be unique.

;URL: A URL configured here is send with any call from this object as source URL. Only H.323 support sending a URL. Some called endpoints may make use of the URL. The URL is also available within the CDRs generated by the gateway.

;Max Calls: Limits the concurrent calls to this object. Any additional call is rejected with "No Channel Available"

;Group Indications: The group for which group indications are sent to the registered endpoints. The object must be active member in this group. The other objects (for which group indications are sent) need not to be active. To monitor other endpoints on a phone with a Partner/Pickup function key group indications are needed for the endpoints. The maximal length of the Group Indication Name in V7 is set to 48 characters.

;Hide Connected Endpoint: This check-mark hides the name and number of the connected endpoint if an object with this check-mark set is called. This applies for example if a call forwarding was configured or the object was a broadcast group. In these cases the connected endpoint is different from the called.

== License ==

For User and Executive objects licenses which shall be used for this user can be configured. The licensed features can only be used if they are checked on this page.

;UCC: includes App(phone), App(softphone), Video, AppSharing, Voicemail, Mobility, Fax, App(chat), App(connect), App(innovaphone-pbx-conferencing), App(innovaphone-assistant), [[{{NAMESPACE}}:Concept_App_Service_Documents|Documents]], [[{{NAMESPACE}}:Concept_App_Service_Conference_Transcriptions|Conference Transcriptions]]
;UCC Upgrade from UC: upgrade license from UC to UCC. Requires availability of UC license.
;UCC Upgrade from Softphone: upgrade license from Softphone to UCC. Requires availability of Phone/Softphone or myPBX license.
When licences are distributed via a configuration template, 'UCC Upgrade from UC' or 'UCC Upgrade from Softphone' licences are used first, if available.
 If no upgrade is possible, a UCC licence is used. This means that all users who are to have UCC functionality can be configured for a UCC licence.
 It is not necessary to explicitly configure individual users for the upgrade.
 This mechanism is available from version 16r1sr4 onwards.
;UC: includes App(phone), App(softphone), Video, AppSharing, Voicemail, Mobility, Fax
;Voicemail:[[{{NAMESPACE}}:Concept_App_Service_Voicemail|Voicemail for this user]]
;Fax:[[{{NAMESPACE}}:Concept_App_Service_Fax|Personal Fax Application]], included in UC/UCC
;Mobility:[[{{NAMESPACE}}:Concept_App_RCC|Mobility device integration]], included in UC/UCC
;myPBX: myPBX client (outdated)
;Video: Video integrated within Phone and Softphone application, included in UC/UCC
;AppSharing: Application Sharing integrated within Phone and Softphone application, included in UC/UCC
;Reporting:[[{{NAMESPACE}}:Concept_App_Service_Reports|Reporting Application]], call lists do not require this license
;App(phone):[[{{NAMESPACE}}:Concept_App_PhoneApp|Phone Application]], included in UC/UCC
;App(softphone):[[{{NAMESPACE}}:Concept_App_SoftphoneApp|Softphone Application]], included in UC/UCC
;App(chat):[[{{NAMESPACE}}:Concept_Chat|Premium Chat application]] with message storage, included in UCC
;App(innovaphone-assistant):[[{{NAMESPACE}}:Concept_App_Service_myApps_Assistant|Assistant Application]], included in UCC
;App(innovaphone-working):[[{{NAMESPACE}}:Concept_App_Service_Working|Working Application]]
;App(innovaphone-switchboard):[[{{NAMESPACE}}:Concept_App_Service_Queues|Switchboard Application]]
;App(innovaphone-recorder):[[{{NAMESPACE}}:Concept_App_Service_Recordings|Voice Recording Application]]
;App(innovaphone-projects):[[{{NAMESPACE}}:Concept_App_Service_Projects|Projects Application]]
;App(innovaphone-pbx-conferencing):[[{{NAMESPACE}}:Concept_Conference|Conferencing Application]], included in UCC
;App(innovaphone-myphonekeys):[[{{NAMESPACE}}:Concept_App_myPhoneKeys|Desk Phone Control]]
;App(innovaphone-microsoft365):[[{{NAMESPACE}}:Concept_App_Service_Connector_for_Microsoft_365|Teams Connector]]
;App(innovaphone-kuando):[[{{NAMESPACE}}:Concept_App_Service_Connector_for_kuando%C2%AE|Kuando Connector]]
;App(innovaphone-connect):[[{{NAMESPACE}}:Concept_App_Connect|Connect Application]], included in UCC

== Devices ==
This section enables assignment and identification of multiple devices for the same user. Those devices may register and operate in parallel for this user.

=== Devices Input Fields ===
; Hardware Id: identifies the connected device to match the incoming registration. Can either be a MAC-address (for fixed phones) or a unique descriptor (for softphones/3rd-pty-terminals).
: Filled in automatically when phones are provisioned by UsersAdminApp or ProfileApp.
: If a hardware id identical to the object name is configured, the name or the number of the object can be used for registration. For registrations with name or number of the object, the settings configured at this device are used in this case.
; Name: can be used for a description of the device.
: On the SOAP/TAPI interface Name can be used to let the user select the device which shall be controlled.
: If no device is configured the Name and Hardware Id are used for default devices to ensure configuration compatibility.
: To allow an endpoint to register with the objects Name or Number, a device must be configured with a hardware id that is equal to the object Name. (E.g. Registrations from DECT Base Stations)
: A registration by number does not succeed if the length of the number does not match, other when dialing an object in which case additional dialed digits are ignored.
: If a registration by number does not match any object number, the number is converted to a name and a device hardware id is searched with this name.
; App: this field allows to configure a V13-App used to control this device. E.g. "phone" or "softphone" in lower letters.
: If a hardware ID is already present, this field is not set automatically during install and thus must be manually set.
: Name field should also be filled with an unambiguous description for use in myApps. Example :
: <table>
<tr>
<th>Hardware Id</th>
<th>Name</th>
<th>App</th>
</tr>
<tr>
<td>009033000000</td>
<td>myDeskphoneName</td>
<td>phone</td>
</tr>
<tr>
<td>exampleSoft</td>
<td>mySoftphoneName</td>
<td>softphone</td>
</tr>
:</table>

=== Devices Config Flags ===

;PBX Pwd: Registration with the PBX master password only

;No IP Filter: Don't apply IP Filters for registrations

;TLS only: Allow Registration with H.323/TLS only. If this check-mark is set a matching certificate, which is trusted by the PBX must be provided.

;No Mobility: If a registration on this device is active don't call a mobility number

;Config VOIP: Add additional config for VoIP. E.g. configure a WebRTC endpoint. Apply has to be pressed once and Name Field must be set to allow enable the additional input page with the "defined" name.
: If this checkmark is set and a '''Name''' is configured for the Device a new tab-sheet with the configured name is available to allow more VoIP Parameters to be configured.

;Reverse Proxy: Allow the device to register through a reverse proxy. The registration through a reverse proxy is identified by the IP addresses configured for reverse proxies

;Single Reg.: Allow a single registration to this device only

;Media Relay: Force Media Relay on the PBX for this device only.
: When this is enabled and the registration of the device is coming in via a reverse proxy server server-reflexive address (SRFLX) obtained via STUN is provided as default media address.
: This feature is used so that third party SIP phones not supporting ICE/DTLS can be used together with the innovaphone PBX as on-site phones as well as phones in home offices or phones in a cloud scenario.

;No SRTP: Do not offer SRTP in SIP/SDP when Media Relay is set at the Hardware ID

=== Security issues ===

There are security build in mechanisms :

* If the '''PBX Pwd''' (in older V9 builds AdminPwd) check-mark is set, registration to this device is only possible with the PBX password, which is configured in PBX/Config/Security.

* The check-mark '''No IP Filter''' allows the registration to the device even if the IP Filter does not match. This way general registration can be restricted using the IP Filters and some selected devices can be opened for registration from the public internet. A registration without password is not allowed in this case. (Available from v9 hf15)

* If this object will have no registration, leave the device field empty (for security reasons). Nobody can abuse and register at that object.

* If a registration request comes with the wrong password the object deny´s '''all''' registration requests (with the reason REGISTER-REJ : Reason=PBX missing Authentication) for 20 seconds. After that time it is possible to register (with the right password).

== Objects with empty node or PBX ==
If an object has no '''PBX''' configured, it will be replicated (if replication is turned on) to all slaves. Furthermore, any PBX will satisfy incoming registration requests. Calls to such objects that are built-in to the PBX and thus do not require a registration to work (e.g. Waiting Queue) will be processed by each PBX the call is presented to.

If an object has no '''Node''' configured, it will be considered to live in the node of each PBX the object is known to. So if an object has neither '''Node''' nor '''PBX''' configured, it will be present in all nodes that have a PBX and calls to such objects will be processed locally for objects that are built-in to the PBX.

Reference16r1:PBX/Objects

2026-08-17T14:05:19Z

Vsc: /* License */

This page is used for the administration of PBX objects. A list of already configured objects can be displayed filtered by various criteria. New objects can be created and existing objects can be changed or deleted.

== Display of existing Objects ==
By pressing the show link, existing objects are displayed. With the filter field (the input field left to the show link) the displayed objects are limited to those matching the filter. The filter is first applied to the 'Long Name' of the objects meaning a non case sensitive head match of the filter and the 'Long Name' is performed. If there are matching objects these are displayed.

If there are no matching objects the filter is used to match the Number of the objects including any node prefixes. This way objects of a given node with all sub-nodes can be displayed by entering the prefix of a node here.

Below the filter input field is a list of all PBXs in the system (at least the part of the system which is replicated to this device). By clicking on a PBX in the list only the objects which are assigned to this PBX are displayed and the groups configured on this PBX are displayed as well. By clicking on a group only the members of this group are displayed.

=== List of Objects ===

On the right side the list of objects is displayed. The most important configuration properties are displayed in this list to provide an overview. To view the full configuration of a given object it must be opened for editing by clicking the Long Name. The list can be sorted by clicking the table headers.

The Number of the objects in this list is not the number configured in the object but it is expanded with the prefixes of the nodes in which the object is configured.

Group memberships and Call Forwarding for an object are changed by clicking on the 'Groups' or 'CF*' link of the object. A '*' appended to a group displayed in this list means that the active flag of this group membership is set.
A '!' appended to a group displayed in this list means that group indications are configured for this group.

Fork number appended by a '*' indicates a mobility enabled user. In case the number is displayed in grey, the user consumes no mobility license on local PBX (e.g. because the user registers on other PBX).

The last column are the IP addresses of registered endpoints for a given object. If the physical location of the endpoint is not the same as the PBX, the physical location is indicated by @<physical-location> added to the IP address. A '*' appended to this field means that this is an password authenticated registration.
Registrations which are because of a standby situation, which means they are not at the PBX for which they are configured, are marked with a special colour (by default this is red).

=== New Objects ===

New objects are created by selecting the type of object in the drop down list and clicking the new link. If the list of displayed objects is limited to a PBX/Group (see above), the PBX property of the new object is preset accordingly and the group membership is added to the object.

== Object Types ==

There are different types of objects for different purposes available

;[[{{NAMESPACE}}:PBX/Objects/User|User]]: A normal User
;[[{{NAMESPACE}}:PBX/Objects/ap|AP]]: Used to enable pbx connection to Application Platform
;[[{{NAMESPACE}}:PBX/Objects/App|App]]: Create a reference to an innovaphone App that can be used in myApps
;[[{{NAMESPACE}}:PBX/Objects/Call Broadcast Conference|BC Conference]]: A Conference which automatically calls other users
;[[{{NAMESPACE}}:PBX/Objects/Boolean|Boolean]]: Used to enable Call Forwards an other things based on time/date or by calling to this object
;[[{{NAMESPACE}}:PBX/Objects/Call Broadcast|Call Broadcast]]: Forward a call to a group
;[[{{NAMESPACE}}:PBX/Objects/Conference|Conference]]: Used to create a conference
;[[{{NAMESPACE}}:PBX/Objects/Config Template|Config Template]]: Config which can be applied to other objects
;[[{{NAMESPACE}}:PBX/Objects/DECT System|DECT System]]: Defines a DECT system
;[[{{NAMESPACE}}:PBX/Objects/Directory Search|Directory Search]]: LDAP lookup based on number dialed
;[[{{NAMESPACE}}:PBX/Objects/DTMF Features|DTMF Features]]: Feature control for simple endpoints
;[[{{NAMESPACE}}:PBX/Objects/Executive|Executive]]: Executive in a executive/secretary configuration
;[[{{NAMESPACE}}:PBX/Objects/External UC|External UC]]: To forward presence subscriptions to external presence server
;[[{{NAMESPACE}}:PBX/Objects/Fax|Fax]]: Defines a fax service
;[[{{NAMESPACE}}:PBX/Objects/Gateway|Gateway]]: For registration of gateways
;[[{{NAMESPACE}}:PBX/Objects/ICP|ICP]]: Integration with ICP system
;[[{{NAMESPACE}}:PBX/Objects/MCast Announce|MCast Announce]]: Calls endpoints and forwards media as IP multicast
;[[{{NAMESPACE}}:PBX/Objects/Message Waiting|Message Waiting]]: Message Waiting for external Systems
;[[{{NAMESPACE}}:PBX/Objects/Messages|Messages]]: used to connect messaging service
;[[{{NAMESPACE}}:PBX/Objects/Mobility|Mobility]]: Mobile Integration
;[[{{NAMESPACE}}:PBX/Objects/Node|Node]]: Numbering Node
;[[{{NAMESPACE}}:PBX/Objects/Number Map|Number Map]]: Maps to other number
;[[{{NAMESPACE}}:PBX/Objects/PBX|PBX]]: To register slave PBX
;[[{{NAMESPACE}}:PBX/Objects/Push|Push]]: Defines a push service
;[[{{NAMESPACE}}:PBX/Objects/Directory Search|Quick Dial]]: Allows Quickdial based on external LDAP Directory
;[[{{NAMESPACE}}:PBX/Objects/Session Border|Session Border]]: Allows proxy registrations to other PBX
;[[{{NAMESPACE}}:PBX/Objects/Settings|Settings]]: control dynamic group memberships via myPBX client
;[[{{NAMESPACE}}:PBX/Objects/Trunk Line|Trunk Line]]: To register a trunk line
;[[{{NAMESPACE}}:PBX/Objects/Voicemail|Voicemail]]: Defines a voicemail service
;[[{{NAMESPACE}}:PBX/Objects/Waiting Queue|Waiting Queue]]: Define a waiting queue

== General Object Properties ==

Some configuration properties are specific to the type of object, some are common to all objects. Not each object type supports all general configuration properties.

;Description: Any text which can be used to describe the objects. Nothing is done with this text on the PBX.

;Hide from LDAP: When this check-mark is set, this object is available with a read-only LDAP access, which means it does not show up in the PBX phonebook on the phones.

;New Account: This checkmark can be set, adding a new User Object after deleting a User Object with the same Name, to that this is a new user and old information should not be reconnected to this user. Without this checkmark set, the name is used to connect the new User Object to the old information. This is mainly useful for information stored in Apps. Not every App does support this feature altready. It is supported by Connect and Chat, so when adding a user the setting of this checkmark means, that this is a new user and the old messages in Chat or Connect from a user with the same name are not visible for this user anymore.

;Long Name: This name is used to identify the object in the database and for display purposes. The long name must be unique throughout the system. For practical reasons, you should limit it to ''20 - extension length'' characters.

;Name
:The name of the object. This name is used for H.323 and SIP signalling (like a call number) and must be unique throughout the system.
:In order for the name to be handled correctly in all protocols, a few rules should be followed regarding the characters used.
:# The name must not start with a "." dot (See [[{{NAMESPACE}}:Concept Group Pickup across PBXs|Concept Group Pickup across PBXs]] for more details on using a dot.)
:# The character "@" must not be used (It is used as separator for E-Mail-Adresses)
:# The character "?" is a specially reserved character to append arguments, which can be used when a call is sent. (See [[{{NAMESPACE}}:PBX/Objects/Trunk_Line| Name as Number]] for more details on using a ?-sign.)
:# It is best to use only characters that are also used in e-mail addresses (before the @ sign). So "a-z0-9-_" in lower case letters.

:Note: Clients ''cannot'' use the ''Name'' and ''Number'' property as registration name without adding the ''name'' as hardware-id.
:Note: it is recommended to use the ''Name'' field for the e-mail address (everything prior the @) in combination with the ''Use as Domain'' flag at the ''System Name''.
:If the 'Name' is to be used as E-Mail address, the Check-mark on the ''E-Mail'' line besides the ''Name'' which is displayed there as well has to be set as well.

;Number
:The telephone number of the object. This is the number by which this object can be dialed within the same node. Which means it does not include any Node prefixes.
:Note: Clients ''cannot'' use the ''Name'' and ''Number'' property as registration name without adding the ''name'' as hardware-id.

;E-Mail: Additional E-Mail addresses for the user. Multiple addresses are separated by ';'. The 'Name' is used as E-Mail address as well together with the 'System Name' as domain. The E-Mail addresses are used to match users from other applications (e.g. Exchange, Fax Server) to PBX User Objects. The first E-Mail address is used as destination if E-Mails are to be sent to the User (e.g. received Fax). If the 'Name' shall be used as E-Mail destination, the check-mark besides the 'Name', which is duplicated to the E-Mail line should be set.

;Critical: If marked as critical the object can only be changed by administrators allowed to edit critical objects

;Password / Retype Password: If a registration password is allocated here, then it must be specified during registration, or otherwise the registration will fail. The length of the password is limited to 23 characters ASCII. Be aware when using Unicode characters like ü,ä,ö,ï,ë,é,ă,î,â,ș,ț,Ă,Î,Â,Ș,Ț,ă,î, due to the conversion from Unicode to ASCII the amount of available characters in your password will be decreased. You can use an online Unicode to ASCII converter to check if the password length is not exceeded.

;Node: The node that the object is assigned to. A Node hierarchy can be configured using Node Objects. Objects which are assigned to the same node can call each other with just the number. To call an object in a different node escapes and node prefixes have to be used. If no node is configured, the object is assigned to the node of the respective local PBX.

;PBX: The PBX that the object is assigned to. This PBX accepts registrations for the object. If no PBX is configured, the object is assigned to the respective local PBX.

;Reject ext. Calls: Calls from external sources to this object are rejected.

;Local: Marks an object as local. Local means that it can be called from endpoints physically located at the same PBX without prefixes even if the calling endpoint is in a different node. Where the endpoint is physical located is defined by the PBX the endpoint contacts first (it may be redirected to another PBX then for registration). If the object does not have a PBX configured the call is routed to the PBX where the calling endpoint is registered.
:''Note: Phones using this mechanism should use a Gatekeeper Identifier of <local-pbx>@<System Name> for registration. This way this mechanism works even if the registration happens without redirection. This can be the case if a secondary address is configured in case the local PBX is down. The registration will then be done without redirection an is not renewed when the local PBX comes up again.''

;Send Number: If an object does a call, the calling party number for this call will be replaced by the number given (if any). Used to hide an extension. If a prefix of '.' is configured, this number is interpreted as a number within the node of the object, if no prefix is configured the number is interpreted as a number within the root node.

;External: This is used together with the ''Name as Number'' Feature of a trunk object. If a ''Name as Number'' configuration is set, starting with '?' it is matched to this entry. If only '?' is configured it always matches. Any digit following the matching part is sent as CLI for calls out through the trunk object.

;Dial In: If this check-mark is set, the external CLI which is sent out on the trunk, can also be used to dial in from the trunk. In this case this CLI must be unique.

;URL: A URL configured here is send with any call from this object as source URL. Only H.323 support sending a URL. Some called endpoints may make use of the URL. The URL is also available within the CDRs generated by the gateway.

;Max Calls: Limits the concurrent calls to this object. Any additional call is rejected with "No Channel Available"

;Group Indications: The group for which group indications are sent to the registered endpoints. The object must be active member in this group. The other objects (for which group indications are sent) need not to be active. To monitor other endpoints on a phone with a Partner/Pickup function key group indications are needed for the endpoints. The maximal length of the Group Indication Name in V7 is set to 48 characters.

;Hide Connected Endpoint: This check-mark hides the name and number of the connected endpoint if an object with this check-mark set is called. This applies for example if a call forwarding was configured or the object was a broadcast group. In these cases the connected endpoint is different from the called.

== License ==

For User and Executive objects licenses which shall be used for this user can be configured. The licensed features can only be used if they are checked on this page.

;UCC: includes App(phone), App(softphone), Video, AppSharing, Voicemail, Mobility, Fax, App(chat), App(connect), App(innovaphone-pbx-conferencing), App(innovaphone-assistant), [[{{NAMESPACE}}:Concept_App_Service_Documents|Documents]], [[{{NAMESPACE}}:Concept_App_Service_Conference_Transcriptions|Conference Transcriptions]]
;UCC Upgrade from UC: upgrade license from UC to UCC
:This option is no more necessary since mid August'26, as my.innovaphone provides a UCC-license for each pair of "UC" and "UCC Upgrade from UC".
;UCC Upgrade from Softphone: upgrade license from Softphone to UCC
;UC: includes App(phone), App(softphone), Video, AppSharing, Voicemail, Mobility, Fax
;Voicemail:[[{{NAMESPACE}}:Concept_App_Service_Voicemail|Voicemail for this user]]
;Fax:[[{{NAMESPACE}}:Concept_App_Service_Fax|Personal Fax Application]], included in UC/UCC
;Mobility:[[{{NAMESPACE}}:Concept_App_RCC|Mobility device integration]], included in UC/UCC
;myPBX: myPBX client (outdated)
;Video: Video integrated within Phone and Softphone application, included in UC/UCC
;AppSharing: Application Sharing integrated within Phone and Softphone application, included in UC/UCC
;Reporting:[[{{NAMESPACE}}:Concept_App_Service_Reports|Reporting Application]], call lists do not require this license
;App(phone):[[{{NAMESPACE}}:Concept_App_PhoneApp|Phone Application]], included in UC/UCC
;App(softphone):[[{{NAMESPACE}}:Concept_App_SoftphoneApp|Softphone Application]], included in UC/UCC
;App(chat):[[{{NAMESPACE}}:Concept_Chat|Premium Chat application]] with message storage, included in UCC
;App(innovaphone-assistant):[[{{NAMESPACE}}:Concept_App_Service_myApps_Assistant|Assistant Application]], included in UCC
;App(innovaphone-working):[[{{NAMESPACE}}:Concept_App_Service_Working|Working Application]]
;App(innovaphone-switchboard):[[{{NAMESPACE}}:Concept_App_Service_Queues|Switchboard Application]]
;App(innovaphone-recorder):[[{{NAMESPACE}}:Concept_App_Service_Recordings|Voice Recording Application]]
;App(innovaphone-projects):[[{{NAMESPACE}}:Concept_App_Service_Projects|Projects Application]]
;App(innovaphone-pbx-conferencing):[[{{NAMESPACE}}:Concept_Conference|Conferencing Application]], included in UCC
;App(innovaphone-myphonekeys):[[{{NAMESPACE}}:Concept_App_myPhoneKeys|Desk Phone Control]]
;App(innovaphone-microsoft365):[[{{NAMESPACE}}:Concept_App_Service_Connector_for_Microsoft_365|Teams Connector]]
;App(innovaphone-kuando):[[{{NAMESPACE}}:Concept_App_Service_Connector_for_kuando%C2%AE|Kuando Connector]]
;App(innovaphone-connect):[[{{NAMESPACE}}:Concept_App_Connect|Connect Application]], included in UCC

== Devices ==
This section enables assignment and identification of multiple devices for the same user. Those devices may register and operate in parallel for this user.

=== Devices Input Fields ===
; Hardware Id: identifies the connected device to match the incoming registration. Can either be a MAC-address (for fixed phones) or a unique descriptor (for softphones/3rd-pty-terminals).
: Filled in automatically when phones are provisioned by UsersAdminApp or ProfileApp.
: If a hardware id identical to the object name is configured, the name or the number of the object can be used for registration. For registrations with name or number of the object, the settings configured at this device are used in this case.
; Name: can be used for a description of the device.
: On the SOAP/TAPI interface Name can be used to let the user select the device which shall be controlled.
: If no device is configured the Name and Hardware Id are used for default devices to ensure configuration compatibility.
: To allow an endpoint to register with the objects Name or Number, a device must be configured with a hardware id that is equal to the object Name. (E.g. Registrations from DECT Base Stations)
: A registration by number does not succeed if the length of the number does not match, other when dialing an object in which case additional dialed digits are ignored.
: If a registration by number does not match any object number, the number is converted to a name and a device hardware id is searched with this name.
; App: this field allows to configure a V13-App used to control this device. E.g. "phone" or "softphone" in lower letters.
: If a hardware ID is already present, this field is not set automatically during install and thus must be manually set.
: Name field should also be filled with an unambiguous description for use in myApps. Example :
: <table>
<tr>
<th>Hardware Id</th>
<th>Name</th>
<th>App</th>
</tr>
<tr>
<td>009033000000</td>
<td>myDeskphoneName</td>
<td>phone</td>
</tr>
<tr>
<td>exampleSoft</td>
<td>mySoftphoneName</td>
<td>softphone</td>
</tr>
:</table>

=== Devices Config Flags ===

;PBX Pwd: Registration with the PBX master password only

;No IP Filter: Don't apply IP Filters for registrations

;TLS only: Allow Registration with H.323/TLS only. If this check-mark is set a matching certificate, which is trusted by the PBX must be provided.

;No Mobility: If a registration on this device is active don't call a mobility number

;Config VOIP: Add additional config for VoIP. E.g. configure a WebRTC endpoint. Apply has to be pressed once and Name Field must be set to allow enable the additional input page with the "defined" name.
: If this checkmark is set and a '''Name''' is configured for the Device a new tab-sheet with the configured name is available to allow more VoIP Parameters to be configured.

;Reverse Proxy: Allow the device to register through a reverse proxy. The registration through a reverse proxy is identified by the IP addresses configured for reverse proxies

;Single Reg.: Allow a single registration to this device only

;Media Relay: Force Media Relay on the PBX for this device only.
: When this is enabled and the registration of the device is coming in via a reverse proxy server server-reflexive address (SRFLX) obtained via STUN is provided as default media address.
: This feature is used so that third party SIP phones not supporting ICE/DTLS can be used together with the innovaphone PBX as on-site phones as well as phones in home offices or phones in a cloud scenario.

;No SRTP: Do not offer SRTP in SIP/SDP when Media Relay is set at the Hardware ID

=== Security issues ===

There are security build in mechanisms :

* If the '''PBX Pwd''' (in older V9 builds AdminPwd) check-mark is set, registration to this device is only possible with the PBX password, which is configured in PBX/Config/Security.

* The check-mark '''No IP Filter''' allows the registration to the device even if the IP Filter does not match. This way general registration can be restricted using the IP Filters and some selected devices can be opened for registration from the public internet. A registration without password is not allowed in this case. (Available from v9 hf15)

* If this object will have no registration, leave the device field empty (for security reasons). Nobody can abuse and register at that object.

* If a registration request comes with the wrong password the object deny´s '''all''' registration requests (with the reason REGISTER-REJ : Reason=PBX missing Authentication) for 20 seconds. After that time it is possible to register (with the right password).

== Objects with empty node or PBX ==
If an object has no '''PBX''' configured, it will be replicated (if replication is turned on) to all slaves. Furthermore, any PBX will satisfy incoming registration requests. Calls to such objects that are built-in to the PBX and thus do not require a registration to work (e.g. Waiting Queue) will be processed by each PBX the call is presented to.

If an object has no '''Node''' configured, it will be considered to live in the node of each PBX the object is known to. So if an object has neither '''Node''' nor '''PBX''' configured, it will be present in all nodes that have a PBX and calls to such objects will be processed locally for objects that are built-in to the PBX.

Reference16r1:PBX/Config/General

2026-08-13T09:57:08Z

Vsc: /* Common */

== Configuration ==

=== Common ===

;PBX Mode: The PBX operating mode
:* '''Off''' - The PBX is disabled. After enabling the PBX a browser refresh is needed to activate additional PBX webpages.
:* '''Master''' - The PBX on this device acts as Master. Within a multisite installation exactly one PBX must be configured as Master.
:* '''Slave''' - The PBX on this device acts as Slave. Within a multisite installation several PBXes can be configured as Slave.
:* '''Standby''' - The PBX on this device acts as Standby for the Master. As long as the master is available, this PBX is not active, but just monitors the Master. If the Master is not available this PBX is active.
:* '''Standby-Slave''' - The PBX on this device acts as Standby for a Slave. As long as the slave is available, this PBX is not active, but just monitors the slave. If the slave is not available this PBX is active.

;System Name: The system Name. On all PBX within a multisite installation the same System Name must be configured. For H.323 endpoints this name is the gatekeeper identifier, for SIP endpoints it is the server name.

;Use as Domain: Uses the ''System Name'' as domain name, together with the name field in the user object the PBX constructs the email address (used for sending emails out ox myPBX). This mechanism is also used for Federation, to federate with other domains.

;PBX Name: The name of the PBX on this device. With this name a PBX is associated to a node. The field 'Name' (not Long Name) of a PBX Node object relates to this name.

;DNS: DNS Name of the PBX. If configured this will be used for myPBX redirects if a client tries to register at a PBX on which the user is not configured.

;Unknown Registrations: If this checkmark is set, the PBX accepts 'unknown' registrations. This means registrations with no matching object configured. If from an endpoint registered in this way a number of an object is dialed, which has no registration active and no 'HW-ID' configured the name used for the registration is configured as 'HW-ID' of this object. This is an easy way to deploy large numbers of phones.

:'''With PBX Pwd only:''' If checked only registrations with a PBX authentication or a verified certificate in case of H.323/TLS are accepted. In this case either "PBX Pwd" or "TLS only" is set in a device generated.

;Reverse Proxy Addresses: Up to 8 IP-Addresses (Mixed IPv4 and IPv6 allowed but no DNS names) can be entered in this field, separated by comma. Registrations from one of these addresses are assumed to be routed through a Reverse Proxy. To the address '/<certificate name>' can be added to also check the TLS certificate of the Reverse Proxy. If the reverse proxy certificate is to be verified, the certificate or the issuer of the reverse proxy certificate must be trusted in the PBX. (If you use a SAN certificate you have to enter the first SAN-Name)
:If empty addresses are used, unauthenticated registrations from unknown or internal addresses are not allowed, but any registration must be authenticated, with a password or the certificate from the reverse proxy.
; Assume TLS: If the ''Assume TLS'' checkmark is set, it is assumed, that the reverse Proxy did a successful check of the TLS certificate against the registration name.

;Media relay endpoint/Firewall public IP: For media relay endpoints (e.g. third party SIP phones) the public address of the firewall of the PBX network can be configured. This address is signaled in the SDP to received RTP from the phone. The firewall should have configured a port forwarding to the PBX or the TURN, for the RTP range of the PBX or TURN.

;Media relay endpoint/TURN: If this checkmark is set, the PBX allocates TURN endpoints for calls to or from media relay endpoints, which registerd thru the reverse proxy (e.g. third party SIP phones)

;IP address for App Platform
: The ip address of an App Platform can be configured here, with a DNS name used for it. If myApps uses a host to access the PBX different from the configured DNS name of the PBX, the hostname in any App url, which matches the configured AP DNS, is replaced by the AP IP. This way it is possible to configure a PBX with DNS names and access it with myApps when the DNS is not yet set up. If the checkmark ''Operation without DNS'' is set as well any matching DNS name is replaced also when an App service requests the URL of another App service (Example: Users requesting the URL of Devices for provisioning) and in the URL sent to the App services itself (Example: Devices uses this URL to construct the URL set at devices for the Devices registration).

: Note that this mode is intended to be able to run the PBX using DNS names while the DNS is not yet in place. Once the DNS is up and running, neither the DNS name of the AP nor its IP address should be configured here.

;Music On Hold URL: A URL for the Music On Hold. This file is read by the PBX using HTTP and sent to a held endpoint via RTP. The format of this URL is

:'''<nowiki>http://<addr>/<file>.$coder?coder=g711a,g711u,g722,g723,g729,opus-nb,opus-wb&repeat=true</nowiki>'''. <addr> is the IP address of the http server, no dns name is allowed here. <file> is the filename. $coder will be replaced by the actual coder used.

:Parameters: ''coder=g729,g711a,g711u,g723,opus-nb,opus-wb'' is the list of available coders. Only these coders must be specified for which a corresponding file exists. ''repeat=true'' should be specified in order to loop the file endlessly. ''random=true'' can be used to start the music on hold on a random point (this will work only if the URL is not local though).

:By default the built-in Music-On-Hold is played (Pseudo URL: "MOH?coder=g729,g711a,g723&repeat=true"). You can also play a dial tone (Pseudo URL "TONE") or a ring-back tone (Pseudo URL "TONE?tone=ringback").

:The maximum length of the URL is limited to 500 characters (bytes).

:If you configure a wrong (or invalid) URL then you will have silence as MOH. To prevent this situation when the MoH for some specific context/user(see below) is missing and silence is played instead of any MoH, an additional parameter ''fallback=true'' is available. If the file provided in the URL is missing (HTTP Error 404 Not Found is delivered by the HTTP Server) and the parameter ''fallback'' is provided, the default MoH will be played instead of silence. To use a custom file as fallback MoH, instead of default MoH, any file name can be provided with the ''fallback'' parameter: e.g. ''fallback=other_filename''. The file other_filename.g7xx must be placed in the same folder as a file provided with URL. A special filename ''fallback=ringback'' can be used to generate a ringback tone (equivalent to ''TONE?tone=ringback'') instead to play an alternative file.

:Within the URL %<id> can be used to put in some context information of the call. The information refers to the party which has put the receiving party on hold. For information about the receiving party itself, the id has to be preceded by '.' (e.g. '''.l''').

:'''l''' Long Name
:'''h''' Name (H.323 id)
:'''n''' Number
:'''N''' Node
:'''P''' PBX
:'''d''' Diverting Name
:'''#d''' Diverting Number

: See [[Howto:Dynamic_MOH]] for more details on how to use dynamic music on hold.

;External Music On Hold: To offload the device from playing the Music on hold, the Music On Hold can be played by a separate device. This device can register with a name configured here. To retrieve the Music On Hold a call is sent to this device. For each held endpoint a call is sent.

;Response Timeout: Global timeout (in seconds) after which any action for no response is taken (e.g. Call Forward on No Response). A timeout configured at any object overrides this value.

;Dial Complete Timeout: Global timeout (in seconds) after which any action for incomplete dialed number is taken (e.g. incomplete destination at trunk object).

;No. of Regs w/o Pwd: Number of registration without password authentication which are allowed per user. If 0 is configured no registration without password is possible.
Pls. note that registrations from 127.0.0.1 w/o password will be accepted anyway

;Security block time(s): Time for which a registration to a user is blocked after attempt with wrong password. Default is 20s. With a value of 0 this features is turned off.

;Recall Timeout: A value configured here enables recall after transfer. If a call is transferred and not answered within this time, the call is sent back to the transferring endpoint.

;No email as call destination: If checked an email address configured at a user cannot be used to call this user. This is useful, if there may be conflicts of email addresses with destinations to be called via federation.

;Chat no Attachments: If checked, no file attachments are allowed in chats for any user

;Retries on busy (14s): Number of retries (Each attempt runs for 14 seconds) of blind transfer to a busy endpoint, before a recall back to the initiator is executed. During an attempt, the PBX waits to see if the target is free, and then delivers the call. The default value are 4-retries if the field is empty. If there is a 0 configured no further (in addition to the initial) will be executed. (This function depends on the ''Recall Timeout'' so the ''Recall Timeout'' must not be empty)

;Max Call Duration (h): Number of hours until a call with media is disconnected automatically. Affects all calls with initialized media channels signalled via PBX.

;Group Default Visibility: Defines additional visibility for active group members. These are added to the visibility rights derived from the [[{{NAMESPACE}}:PBX/Objects/Visibility | Visibility settings]] in user or template definitions. Note that changes made here only take effect after a re-registration.

;Presence with Alert: Enable presentation of presence on phone upon alert. Setting applies for all PBX users.

;Enable External Transfer: Unless this checkbox is set any attempt to transfer an external call back to an external destination will result in disconnection of the call.

;No CLIR on Internal calls: If checked numbers are displayed even if received with presentation restricted. When sending a call presentation restricted can still be set and should be honored by a public network.

;Disable reconnect: Disables the automatic reconnect feature if a client lost or change the network. Available from 16r1sr4.

;Media Relay:
:;Off: No Media Relay is done in the PBX
:;On: All media traffic is routed through the PBX. With the '''No Media Relay if Addresses are identical or private''' checkmark, this is not done if the two call endpoints registration addresses are either private or equal (i.e. external endpoints behind the same NAT router). To identify an address as private the "Private Networks" configuration from ''IP4/General/Settings'' is used.
:;Auto: Media traffic is routed through the PBX if calls are between private and public registration addresses but not for calls between private and private or public and public registration addresses. To identify an address as private the "Private Networks" configuration from ''IP4/General/Settings'' is used. In v11 this was the behaviour if ''RTP Proxy'' was ''on''.
: Please note that when media relay is in effect for a call, '''video is not working'''. With ICE (available from v12r1), media relay in the PBX should be obsolete except for special applications. Check ''On'' or ''Auto'' only if you need to have this, since it creates CPU load on the PBX.

;Generate CDRs: If this checkbox is set, the PBX generates CDRs for all calls. For details, refer to the [[{{NAMESPACE}}:Concept_Call_Detail_Record_CDR_PBX|CDR description article]].

;Reverse Lookup URL
: A String in the LDAP URL Format according [https://tools.ietf.org/html/rfc2255 RFC2255] which will be used by the PBX to make a lookup for all external numbers.
: Number resolutions will be forwarded to internal applications like generated CDRs, Phone App etc..
: Example: ''ldaps://ap.innovaphone.com/dc=entries?givenname,sn,company?sub?(metaSearchNumber=+%n)?bindname=innovaphone.com\contacts''
:* dn: ''dc=entries''
:* attributes: ''givenname,sn,company''
:* scope: ''sub''
:* filter: ''(metaSearchNumber=+%n)''
:** %n is a placeholder for the given cgpn
:* extension: ''bindname=innovaphone.com\contacts''
:** The username for the authentication.
:'''Variables'''
:* %n - cgpn
:* %u - h323 name of the current object
:'''Password''': Password to authenticate access for the used ldap source. Leave empty if not required.
: Examples for use of different ldap directories are listed in the [[{{NAMESPACE}}:Concept_Number_Resolution_and_LDAP#PBX_Configuration|Concept Article]]

;Logo URL
:The URL to a customized logo image that will be displayed on the phones. Leave empty to keep the standard logo. The image size should be 220x150px or less with 24Bit color deep or less and an RGB range. The file format should be PNG or JPEG.

;Route Root-Node External Calls to: Destination object (Long Name) of Root-Node external calls. This configuration option is available on the Master or Standby PBX only. Any call which cannot be terminated inside the PBX is sent to this destination as long as neither the source nor the destination of the call can be associated with a node with a PBX configured. This object must be assigned to this PBX.
:'''For calls from local PBX only''': If set on a master, calls from a slave are not sent to this destination but sent back to the slave where the call came from. On the slave the call is then sent to a destination configured with 'Route Root-Node External Calls to'.

;Route PBX-Node External Calls to: Destination object (Long Name) of PBX-Node external calls. Any call which cannot be terminated inside the PBX is sent to this destination as long as the source nor the destination of the call can be associated with the node of this PBX. If a call is sent from or to an object defined inside the node of this PBX or in a node hierarchically below the node of this PBX the call is associated to the node of this PBX. This object must be assigned to this PBX, that is, it has to register to this PBX.

;Route Internal Calls to: Destination object (Long Name) to which any call is sent for which a PBX internal destination was found, except for those calls that originated from that object. This can be used to apply special routing on PBX internal calls.

;Escape Dialtone from: The PBX object (Long Name) to which a call is made to get a dialtone if a dialtone is configured for the escape of a node. As above, this object must be assigned to this PBX.

;Prefix for Intl/Ntl/Subscriber/Area-Code/Country-Code: Prefixes to be used to map International, National and Subscriber numbers.
:* '''International Prefix''' (<code>000</code> in Germany).
:* '''National Prefix''' (<code>00</code> in Germany).
:* '''Subscriber''' (in Germany, <code>0</code> is a commonly used trunk line access code).
::The SubscriberID is used for hotkey-actions within myAPPs-launcher. By use of node-objects, adjust the Subscriber Prefix in the respective [[{{NAMESPACE}}:PBX/Objects/Node#Number_Mapping_.28International.2C_National.2C_Subscriber_Prefix.29|node object number mapping]].
::For myPBX-launcher hotkeys, refer to the [[{{NAMESPACE}}:Phone/User/Directories#Dialing_location|dialing location settings]].

:* '''Area-Code''' (in Germany for example, the town Mannheim has area code <code>621</code>).
:* '''Country-Code''' (for Germany, <code>49</code> would be used)

: These settings resemble the same settings found in the [[{{NAMESPACE}}:PBX/Objects/Node | Node]] and [[{{NAMESPACE}}:PBX/Objects/PBX | PBX]] object. However, they apply to the ''root'' node instead (and should be consistent through all PBXs in a multi-PBX system).
'''Max. length internal number'''

If the dialled number is 7 digits or longer, the subscriber prefix is added. Applies to phone and softphone app. PBX and myApps must be reset following the change. Refer to the [[Reference13r1:Concept_Number_Adjustments_(Dialing_Location)#Phone_App,_Softphone_App|respective concept]].
;Adjust LDAP results for e.164: Add a "+" prefix to an PBX-internal LDAP-contact-search result. This is used for 3rd-party- and DECT-phones which are not able to benefit from the Dialing Location settings in case of LDAP-search in an E.164-setup. See also [[{{NAMESPACE}}:Concept_Number_Adjustments_%28Dialing_Location%29#PBX_database_used_as_LDAP_database|concept description]].

;Tones: The tones scheme to be used for PBX generated dialtones. This applies to dialtones generated for node prefixes, ringback on transfer and some more.

=== Slave PBX ===

If the PBX is operated in Slave mode, then the Slave PBX section is displayed

;Registration: The VOIP protocol used for the registration to the master. Possible choices are H.323, H.323/TCP or H.323/TLS.

;Master: The IP address of the PBX master

;License Only: If set, the PBX obtains license from master, but acts as master in all other respects.

;Alternate Master: The IP address of an alternative PBX master (standby, if available)

;Password: The password to be used for registration at the Master as configured in the corresponding PBX Object (The length of the password is limited to 16 characters)

;Master GK-ID: The System Name/Gatekeeper ID of the PBX Master were will register (Optional, usually used for DynPBX).

;Replication: This parameter allows you to select the replication style for the slave PBX: either ''All'' or ''Local'' (only users that need to be known in this PBX). For the replication process the [[Reference9:PBX/Config/Security|PBX Password]] is used which have to be the same password on all PBXes in the system.

;dyn PBX ID: This parameter allows to set replication from a specific DynPBX configured on the Master Device.

;Use local static User DB: A dynPBX has also this checkmark. The database of the main PBX is used, but be careful due to the increased memory usage. The dynPBX will create its own PBX datastructure which allocates memory.

;Route Master calls if no Master to: If the master is not available, master calls are sent to this destination. Destination has to be an object with active registration.

;Max Calls to Master/No Reroute: This parameter can be used to limit the calls to the master. If a call is sent to the master and there are already calls to/from the master equal to or exceeding this value, the call is rejected if '''No Reroute''' is set or is handled as if the master was not available otherwise.

;License Limits: Here we can set limit of licensing for this Slave PBX for Port, Mobility, Operator and Softwarephone.

For complete replication from master to slave, check also password in [[Reference9:PBX/Config/Security#PBX_password]]

=== Standby PBX ===

If the PBX is operated in Standby mode, then the Standby PBX section is displayed

;Master: The IP address of the PBX master

;Replicate from Master: Turns on full replication from the master PBX

;use TLS: Use LDAPS (TLS) instead of LDAP (TCP).

For complete replication from master to slave or standby, check also password in [[Reference9:PBX/Config/Security#PBX_password]]

Reference16r1:Concept App Service Connector for Microsoft 365

2026-08-11T14:01:36Z

Vsc: /* Concept */

[[Category:Concept|Apps]]
== Applies To ==

* Connector for Microsoft 365 from Version 16r1

= Overview =

Connector for Microsoft 365 synchronizes Microsoft Teams presences with the innovaphone PBX and back, and optionally additionally Calendar presence from Exchange Online (part of the Microsoft 365 Cloud Services).
It is also possible to search for your own contacts.

== Requirements ==

* innovaphone PBX
* innovaphone Application Platform (minimum version 120004)
* V16r1
* App(Connector for Microsoft 365)
* PBX-App(innovaphone-microsoft365) license per user - order no. 02-00050-009

== Concept ==

=== User Presence ===

==== Configuration ====
Please have a look into our [[Howto16r1:Configure User Presence Sync by Connector for Microsoft365|Howto guide for basic configuration aid on user presence synchronisation]].

==== Technical Overview ====
If the Connector for Microsoft 365 app is fully configured, the app connects to Microsoft to obtain a token. With the token, the app gets the teams users (with a Teams license) through the Microsoft Graph API.
A presence subscription to Microsoft is started with the licensed users of the PBX to get presence changes in Microsoft Teams for these users. A user subscription is also started to get changes of the users (adding, deleting or update). If a user has changed, the Teams users are retrieved again. If the presence has changed, it is forwarded to the PBX. The presences of Teams are mapped to the presences of the PBX.

* User subscriptions are renewed every 60 minutes.
* Presence subscriptions are renewed every 10 minutes.
* License Check is made periodically.

The app synchronises the PBX presence with Teams through the Graph Api. The on-the-phone presence will be renewed every 5 minutes. The other presences have a lifetime of 1 day but the away has a lifetime of 7 days.
The lifetimes are described [https://learn.microsoft.com/en-us/graph/api/presence-setuserpreferredpresence?view=graph-rest-1.0&tabs=http here]

'''Please be aware:''' The actual change of presence or line state will be live, the above-mentioned subscriptions are needed to register against the Microsoft API for changes.
After successful subscription Microsoft will trigger the Connector for Microsoft 365 App every time a presence or line state for a user has changed.
The subscription will then be renewed in the above-mentioned time interval to receive further live updates.

===== User Matching =====
You now can choose the fields used for user matching on either side from the following options:
* PBX
** CN (Long Name property from the PBX user object)
** h323 (Name property from the PBX user object)
* Azure Portal
** displayName
** mail
** mailNickname
** onPremisesDistinguishedName
** onPremisesSamAccountName
** onPremisesUserPrincipalName
** userPrincipalName

Additionally, you have the possibility to remove a possibly contained domain from the Azure fields content. 
Example: 'user@domain.tld' is transformed to 'user', if this option is checked.

===== Mapping Table =====

{| class="wikitable"
|-
! Teams Presence
! PBX Presence
|-
| Away
| away
|-
| BeRightBack
| away
|-
| Busy
| busy
|-
| DoNotDisturb
| dnd
|-
| InACall
| on-the-phone
|-
| InAMeeting
| meeting
|-
| Inactive
| online
|-
| PresenceUnknown
| online
|-
| Available
| online
|-
| Offline
| online
|-
| Offwork
| online
|-
| OutOfOffice
| away
|-
| UrgentInterruptionsOnly
| dnd
|-
| Presenting
| on-the-phone
|-
| InAConferenceCall
| on-the-phone
|}

The value "online" unsets the Teams presence in the PBX.

===== Master/Slave =====

For Master/Slave combination the "Connector for Microsoft 365" App has to be added to the slave (if no full replication is on). The slave websocket connection is needed to display "on-the-phone" presence.

=== Calendar Presence ===

==== Configuration ====
Please have a look into our [[Howto16r1:Configure Calendar Presence Sync by Connector for Microsoft365|Howto guide for basic configuration aid on calendar presence synchronisation]].

==== Technical Overview ====
Introduced in 15r1 the Connector for Microsoft 365 will offer a possibility to sync Azure Portal calendar events (Teams, Exchange online) via the Graph API with the PBX presence. 
For now the [https://wiki.innovaphone.com/index.php?title=Reference13r3:Concept_App_Service_Calendar Calendar App] is (along with other functions) also capable of syncing calendar events, but using the old EWS mechanism, which Microsoft announced as end of life starting from 2026. 
'''Warning:''' Please make sure to not use both apps for syncing calendar events in parallel, this is not supported and will most likely lead to conflicts and unexpected behaviours. 
 
When the configuration of the connector for Microsoft 365 Calendar Presence Sync is complete, the app connects to Microsoft to receive a token with the calendar app registered in the Azure portal. 
With the token, the app can pick up the users from the Azure portal. 
These are matched against the users in the PBX, based on the configured "User Assignment" settings. 
For each matched user with a valid Connector for Microsoft 365 licence applied, a subscription for calendar events is created at Microsoft to receive event changes in Microsoft Calendar for these users. 
 
A user subscription is also started to receive user changes (add, delete or update). 
If a user has changed, the users are retrieved again. 
 
If a calendar event has been started or ended, it is forwarded to the PBX. 

* User subscriptions are renewed every 60 minutes.
* Event subscriptions are renewed every day.
* License Check is made every hour.

=== Contact Search ===

==== Configuration ====
Please have a look into our [[Howto16r1:Configure_Contact_Search_by_Connector_for_Microsoft365|Howto guide for basic configuration aid on contact search]].

==== Technical Overview ====
Introduced in 16r1 the Connector for Microsoft 365 will offer a possibility to search for your own contacts (Teams, Exchange online) via the Graph API.

When the configuration of the connector for Microsoft 365 Contact Search is complete, the app connects to Microsoft to receive a token with the contact search app registered in the Azure portal. 
With the token, the app can pick up the users from the Azure portal. 
These are matched against the users in the PBX, based on the configured "User Assignment" settings. 
For each matched user with a valid Connector for Microsoft 365 licence applied, the user can search with the Phone App, for example (a myApps search provider will be provided for all apps looking using search providers looking up contacts). The search string is made available to the Connector for Microsoft 365 via the microsoft365-api. The results are sent to the consumer, e.g. the Phone App and presented there. 
 
A user subscription is started to receive user changes (add, delete or update). 
If a user has changed, the users are retrieved again. 
 

* User subscriptions are renewed every 60 minutes.
* License Check is made every hour.

'''Be aware:''' Since the Connector for Microsoft 365 is an app in the Scope of myApps App Platform, IP Phones and other services not using Apps cannot benefit from this search service.

== Related Articles ==

=Known Limitation=

== General ==
''Applies to the User Presence and the Calendar Presence''

=== Synchronization Delay ===
In the official Graph-API documentation, Microsoft is providing an overview about expected latencies for change notifications. 
You can find a whole overview table here: 
https://learn.microsoft.com/en-us/graph/change-notifications-overview#latency 
 
For the user presences the resource "presence" is used and an average latency of 10 seconds but a maximum up to 1 minute is provided. 
Such a delay in syncing changed presences from Teams down to the PBX are considered normal and are caused by the Microsoft Graph-API. 
 
In case of calendar events the average is provided as "less than 1 minute" and the maximum to 3 minutes. 

== User Presence ==
=== Line states set by the PBX does not block calls in Teams ===
Line states set by a 3rd party application (like the Connector for Microsoft 365) through the graph API are currently '''only for display purpose and do not block new calls''' in Teams. 
 
https://techcommunity.microsoft.com/t5/teams-developer/ms-graph-setpresence-problems/m-p/2798805/highlight/true#M3957 
As you can see in the above linked discussion, there once existed a feature request on Microsoft Voice, which is no longer available since it was not voted.
=== Maximum number of supported users ===
The connector now supports multiple Microsoft Teams communication users, which is the prerequisite to subscribe for more than 650 users. There is a new ribbon (Manage Teams Accounts) that allows you to configure as many communication users as you need. Every configured communication user can be used to subscribe 650 users, for example:

*3 configured communication users x 650 licensed users = 1950 users can be subscribed
'''Please be aware''': Each communication user must have a Teams license applied.

This limitation is caused by Microsoft. 
In the documentation of the Graph-API you will find a hint to this limitation: 
https://learn.microsoft.com/en-us/graph/changenotifications-for-presence#subscribe-to-multiple-users-presence 
Trying to subscribe more than 650 users (with one communication user) by using the presence subscription API will be declined by the graph API with an error message, that too many users are requested. 

=== Communication User (UserSynctoPbx) ===
Users with multi-factor authentication (MFA) are not supported as technical communication users for the Connector.

''We recommend creating a dedicated user account for this purpose rather than using an existing user account.'' 
''This limitation applies only to technical users used for the Connector for Microsoft 365, not standard user accounts. MFA can be used for real users.''

=== Multiple sites / instances require multiple communication users ===
Each instance or each site must have separate communication users, as Microsoft only allows one concurrent subscription per communication user. (otherwise an HTTP 409 conflict will occur)

This means that if you want to subscribe to the same Azure Portal backend from two different sites (or instances), you will need to have multiple communication users (each with an applied Teams licence) in order to be able to subscribe from all endpoints.

=== Subscription Timeout ===

==== Situation ====
Due to a current limitation in the Graph API it is not possible to cancel or delete an active presence subscription. 
As you can see in the [https://learn.microsoft.com/en-us/graph/api/subscription-delete?view=graph-rest-1.0&tabs=http|documentation of the current Graph API (1.0)] the “Delete subscription” chapter does not include presence subscriptions. 
It is also not possible to have multiple subscription in parallel. 

To make sure to only request a new presence subscription when the old one is not valid anymore, the app will store the state of the presence subscription and the time until it is valid in the database. 
As mentioned in the chapter “Technical Overview” we are creating presence subscriptions with a validity of 10 minutes. 
The presence subscription will be renewed as soon as it is no longer valid which will be 10 minutes after initial subscription. 

==== Impact ====
If settings are changed or the app instance is restarted it will check the corresponding database entry on startup. 
In case the last presence subscription was completed less than 10 minutes ago, there is still an active presence subscription and the app has to wait for it to become invalid. 
Some Changes (e.g., to the “Notification-URL”) will only take effect after a new created subscription. 

The current Beta Version of the Graph API is already providing a function to delete presence subscriptions, so we hope we can improve this behavior in the future. 

=Troubleshooting=
== General ==

===Creating an app trace===
For further analysis and creating a support ticket it will be useful to have a suitable app trace. 
Before creating the trace please make sure the following trace flags are activated for the app instance:
* App
* App WebSocket
* Config
* Database
* HTTP client
* TCP
* TLS
* Webserver

After setting the config flags, please make sure to
* stop the instance
* deleting the current instance log
* start the instance
'''Now please wait at least 5 Minutes before you save the log''', otherwise we could not have the whole picture in the trace.

The restart and deletion of the the old log is useful the see the complete initialization process right away.

===SSL Certificate for notification URL===
It also is useful to make sure the notification URL has a valid and public signed certificate. 
You can do that, using an SSL-Checker, for example: https://www.sslshopper.com/ssl-checker.html 
Without a valid, public signed certificate, Microsoft will decline the connection since it will not be possible to establish a trust relationship for the SSL/TLS secure channel.

===Correctness of notification URL===
You can try to open the notification URL in your Browser 
Most likely you will see a HTTP 404 (Not Found) error message, which is the expected behavior since we are not providing an HTML website, the HTTP GET request from the browser will not be answered with content. 
This is perfectly fine since Microsoft will send presence updates with HTTP POST and will not try to request content from our app. 
 
What you can find out by trying to open the URL in your browser are the two following things: 
* If you receive a HTTP 404 error message you are most likely connected to an App Platform, if not you need to check your DNS (and maybe also reverse proxy) settings.
* If the URL is modified and the used build number is added, an app has answered your request
** Example: <code>https://public.dns/your.domain/microsoft365/subscriptions</code> is modified to <code>https://public.dns/your.domain/microsoft365/1510411/subscriptions</code>
** If this is not the case, your URL is wrong. (Be aware: The URL depends on the settings of the web server path of your app instance)

'''Be aware:''' The URL-Recognition in the Application Platform is '''case sensitive'''.

=== Activation of "Public client flow" for the registered app in Azure Portal===
If the subscription is not working at all, please make sure "Public client flow" is activated for the registered app in the Azure portal (as described in our [[Howto16r1:Configure User Presence Sync by Connector for Microsoft365#Create an App for syncing Teams to PBX|HowTo article]]). 
 
The App Service trace will contain the following message if this is not the case: 
<code>AADSTS7000218: The request body must contain the following parameter: 'client_assertion' or 'client_secret'.</code>

== User Presence ==
===GUI Feedback===
The app itself shows required states with green and red as connections to the Master PBX, Authentication and Presence Subscription to identify if there are problems. 
Sometimes it needs a little bit time until the states are changed. 
If the states remain, it is mandatory to enable logs on the app platform and check for more information. 
([[Howto13r3:Configure Connector for Microsoft365#Creating an app trace|Concept App Service Connector for Microsoft 365: Creating an app trace]])

====No connection to Master PBX====
Check the MasterPBX name. 
The field must only contain the name [pbx], '''not the full domain''' [pbx.domain.tld]. ([[Howto13r3:Configure Connector for Microsoft365#Synchronization from Teams to the PBX|Synchronization from Teams to the PBX - Master PBX field]])

====Presence subscription failed====
There are many reasons why the "Presence subscription failed" message could be displayed. 
We try to list the most common reasons:
* The permission for the registered app in the Azure portal are not correctly set ([[Howto13r3:Configure Connector for Microsoft365#Create an App for syncing Teams to PBX|Howto: Create an App for syncing Teams to PBX]])
* The Notification URL is wrong ([[Reference13r3:Concept App Service Connector for Microsoft 365#Correctness of notification URL|Concept App Service Connector for Microsoft 365: Correctness of notification URL]] )
* The App service is not reachable from the internet ([[Reference13r3:Concept App Service Connector for Microsoft 365#Correctness of notification URL|Concept App Service Connector for Microsoft 365: Correctness of notification URL]] )
* The certificate for the public endpoint (e.g. reverse proxy) is not valid, or not publicly signed ([[Reference13r3:Concept App Service Connector for Microsoft 365#SSL Certificate for notification URL|Concept App Service Connector for Microsoft 365: SSL Certificate for notification URL]])
* The user from PBX and the Azure Portal cannot be matched ([[Reference13r3:Concept App Service Connector for Microsoft 365#User Matching|Concept App Service Connector for Microsoft 365: User Matching]])
* The App Platforms clock time is wrong ([[Reference13r3:Concept App Service Connector for Microsoft 365#App Platform clock time is wrong|Concept App Service Connector for Microsoft 365: App Platform clock time is wrong]])
* No user has a valid Connector for Microsoft 365 App license ([[Reference13r3:Concept App Service Connector for Microsoft 365#Requirements|Concept App Service Connector for Microsoft 365: Requirements]])

===Teams License for communication user===
If presence subscription does not work, please check if all of the configured communication users have a Microsoft Teams license applied and no multifactor authentication is in use for this particular user. 
Also please make sure you can login with the configured credentials. (If you have set a password as an Administration, the user needs to change the password during the first login, therefore the given password will be invalid for API access). 
''Sometimes, after changing setting or after the instance has restarted it can take up to 12 minutes until the presence subscription is working correctly. (Due to the subscription timeout)''

= Known Issues =
== Special Characters In Password ==
If you are using special characters (*, &, (, ), etc.) in your password you could run into a problem with the authentication of the communication user. 
The authentication failed status is being displayed. 
For the moment the only workaround is to eliminate special characters from your password.

==App Platform clock time is wrong==
If the clock time at the App Platform is not correct, this will lead to an unstable behaviour of the Connector for Microsoft 365. 
Since the Connector for Microsoft 365 is using the Microsoft Graph APIs presence subscription function, it needs to provide in its request a precise time until the subscription validity will be expired. 
The app service is handling subscription and will automatically recreate a new subscription each time the previous one has expired. 

A wrong clock time will lead to false expiration times and thus
* the subscription will be expired earlier than expected (synchronisation is not working because there is no valid subscription)
* the subscription will be valid longer than expected (the app service is trying to create a new subscription because it is expecting the previous one to be expired - will lead to a 409 conflict error, because only one subscription can be valid at a time)

If you are not sure about the current time of the App Platform, you can login via SSH into the App Platform and execute the <code>date</code> command to check the current time. 
You will receive an output like:
Tue Mar 12 13:38:57 UTC 2024
Please be aware: The time is displayed in UTC, so please make sure to convert to your local time zone.

==Geoblocking==
Since there might be no reliable country assignment for Microsoft addresses, all Microsoft addresses must be enabled on the upstream firewall in the event of geoblocking in order to ensure functionality of the Office365 Connector. 
As an alternative you might be able to configure your firewall to bypass the geoblocking for the configured notification URL.

= Related Articles =
[[Howto16r1:Configure User Presence Sync by Connector for Microsoft365]] 
[[Howto16r1:Configure Calendar Presence Sync by Connector for Microsoft365]] 
[[Howto16r1:Configure Contact Search by Connector for Microsoft365]]

[[Category:Howto|{{PAGENAME}}]]

Reference16r1:Concept App Platform

2026-08-10T13:11:45Z

Vsc: /* Security */

= General =
* V16 uses [https://buildroot.org/ buildroot]
* this is an own (innovaphone) collection of packages
* For further information see: [https://buildroot.org/docs.html Buildroot Documentations]

== Requirements ==

* V13 or above
* Gateway (arm): IPx10 (with CF card) or IPx11 (with mSATA SSD)
* Gateway (arm64): IPx13 (with m2 SSD)
* Virtual (x86_64)
** HyperV with [https://docs.microsoft.com/de-de/windows-server/virtualization/hyper-v/deploy/upgrade-virtual-machine-version-in-hyper-v-on-windows-or-windows-server#supported-virtual-machine-configuration-versions VM-configuration Version] 6.2 (minimum: Windows 10 or Windows Server 2016)
** VMWare
** Proxmox/KVM/Qemu

== Default credentials ==

'''During INSTALL, the default passwords are replaced with the global Admin PW!'''
* SSH-Login with '''admin''' and '''ipapps'''
* root login with '''root''' and '''iplinux''' (the root login is not directly possible, you have to login as admin first and use the command ''su root'')
* manager App (web login) '''pwd'''

= App Platform - arm/arm64 (Gateway)=

* The installation image has a size of ~50MB. During installation, the following partitions are created<ref name="partition-size">Maximum partition sizes are given. The real sizes are returned by the linux 'df -h'-command. These real values will be lower, but can grow in the future with new releases.</ref>:
** /dev/sda1 fat32: 200MB (contains ramdisk, rootfs and kernel)
** /dev/sda2 ext4: depends on disk size (contains databases, log files and apps)
** /dev/sda3 ext4: 500MB (contains the rootfs)
** /dev/sda4 swap: 512MB

When comparing potential performance of the IPxx11 platform compared to the IPxx10 platform, there are some major differences:
* SSDs found in the xx11 are faster and more reliable than the CF found in the xx10
* the available RAM for the App Platform (as specified in column ''RAM for LAP (GB) out of RAM'' in chapter ''Technical data and recommended number of users supported'' of [[Howto:How to implement large PBXs#Technical data and recommended number of users supported|How to implement large PBXs]]) is factor 6 larger on the xx11 (1,536 GB) than on the xx10 (0,256 GB))
* the xx11 has gigabit Ethernet while the xx10 has 100Mbps Ethernet. The xx10 is therefore not well suited for Apps with larger network traffic, such as Recordings
* the CPU of the xx11 (although it runs on the same frequency) is roughly 20% faster than the xx10

While it is hard to predict the performance of the App Platform in a specific scenario, we see that in a real life environment an App Platform running on an xx11 platform can well support 150 users. The xx10 platform is estimated to support 120 users. Because CPU performance is the limiting factor, larger setups can be built based on the virtual machine platform (see [[#App services and multi-threading|App services and multi-threading]] below).

<references/>

= App Platform - x86-64 (Virtual Machine 64bit) =

* The default disk size is 16GB. It should be increased '''before''' the first start if needed!
* Multiple CPUs are supported, default is one CPU
* default RAM: 512MB
* static IP address, DNS, Gateway can be configured with the command '''setip''' on the console. Run '''setip --help''' to get a list of parameters. (Example: setip --addr=x.x.x.x --mask=x.x.x.x --gateway=x.x.x.x --dns1=x.x.x.x)
* If you have permission problems change to su user (Password is iplinux or your new admin password)
* To figure out your ip address you can use the command: ''ip address'' on the console.
* '''loadkeys de''' can be used to change to german keyboard layout (etc.)
* partitions<ref name="partition-size">Maximum partition sizes are given. The real sizes are returned by the linux 'df -h'-command. These real values will be lower, but can grow in the future with new releases.</ref>:
** /dev/sda1 ext2: 350MB (contains ramdisk, rootfs and kernel)
*** the real partition format size is smaller but there is no need to monitor sda1 as sda1 won't grow during usage of the App Platform
*** sda1 is completely exchanged during an image update and its size might have changed but will never exceed these 350MB
** /dev/sda2 ext4: depends on disk size (contains databases, log files and apps)
** /dev/sda3 ext4: 500MB (contains the rootfs)
** /dev/sda4 swap: 512MB
* VMWare Tools: Open VM Tools
* Qemu Guest Agent: installed since 110032
** The qemu guest agent can be configured in Proxmox with ''Virtio'' or ''ISA''. Before version 130012, you must use ISA, as Virtio was not supported with older versions.

<references/>

= Installation =
==ARM Gateway==

If you setup a Gateway with the install procedure, the App Platform is installed automatically (Https Download has to be allowed and shouldn't be blocked by any firewall.) 
You can also install it manually:
* Open App Platform -> General and '''Enable Linux Support'''. Restart the gateway.
* You need to enable Proxy-ARP on [[{{NAMESPACE}}:IP4/ETH/IP|ETH0]] or [[{{NAMESPACE}}:IP4/ETH/IP|ETH1]], so your Gateway and the Linux Appliance will share the same physical interface.
* Open App Platform -> IP and configure the IP settings of the App Platform. Restart the Gateway.
* Open App Platform -> Installation and select the given version or enter an own path to the ''app-platform-armel.img'' image file.
* The installation runs without any further required step.

==ARM64 Gateway==

If you setup a Gateway with the install procedure, the App Platform is installed automatically (Https Download has to be allowed and shouldn't be blocked by any firewall.) 
You can also install it manually:
* Open App Platform -> General and '''Enable Linux Support'''. Restart the gateway.
* You need to enable Proxy-ARP on [[{{NAMESPACE}}:IP4/ETH/IP|ETH0]] or [[{{NAMESPACE}}:IP4/ETH/IP|ETH1]], so your Gateway and the Linux Appliance will share the same physical interface.
* Open App Platform -> IP and configure the IP settings of the App Platform. Restart the Gateway.
* Open App Platform -> Installation and select the given version or enter an own path to the ''app-platform-arm64.img'' image file.
* The installation runs without any further required step.

==Virtual machine==

* Import the image into your server environment.
** Proxmox: follow this description here, just with the app-platform-ova.zip: https://wiki.innovaphone.com/index.php?title={{NAMESPACE}}:Concept_Innovaphone_Virtual_Appliance#Proxmox_VE
* Edit the disk size, if needed.
* Start the machine and wait until it reboots and starts again.
* Note: If you need to access an IP addresses available through a VPN connection from from inside the virtual machine, it could be that you need to set the network of your VM to NAT (and also add the URL for an IP to /etc/hosts)

[https://wiki.innovaphone.com/index.php?title={{NAMESPACE}}:Concept_Innovaphone_Virtual_Appliance#Configuration More Configuration Hints regarding VM Ware]

== Backup of the Apps ==

Each App Service can have multiple instances and each instance has its own database. The manager app itself also has its own database. 
There are no other files which need to be backuped. 
The standard way to backup the databases is through the Devices App [[{{NAMESPACE}}:Concept_App_Service_Devices#Backups]]. 
 
An alternate way is to use a command file which is similar to the command files from the firmware.

===Commands===
* '''times''' 0,12 # backup only at 0 or 12 o'clock
* '''backup-instances''' http://user:pw@ip/path/#I-#D.dump PUT
** PUT and POST are supported, all instances including the manager itself are saved
* '''backup-instance''' http://user:pw@ip/path/#I-#D.dump apidemo example.com PUT
** backup a single instance with instance name and instance domain
* '''backup-manager''' http://user:pw@ip/path/#I-#D.dump

===Hash parameters===
* #L App Platform label (neu), e.g. 10024
* #A App label (neu), e.g. 130004
* #I instance name (neu), e.g. reporting1
* #D instance domain (neu), e.g. innovaphone.com
* #m MAC address of the LAP, e.g. 00ab11eeff
* #d Current date and time (plain UTC without daylight saving and timezone adjustments) 20051010-170130
* #bn rolling backup index (n >=0 and <= 9, just one digit)
* ## escapes a hash mark

= App Platform Infrastructure and Concept =
== Webserver ==
The app platform includes a webserver that is highly optimized for handling many Websocket connections at a low memory footprint.
All apps use that webserver by registering for specific HTTP subpath. So they can all use the same HTTP/HTTPS ports - typically the standard ports.

=== Import Custom SSL Certificate ===
You have to upload a PEM Certificate with the following chain structure and without password encoding.

-----BEGIN CERTIFICATE-----
(certificate: eg. your_domain_name.crt)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(Intermediate certificate: eg. DigiCertCA.crt)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(Root certificate: eg. TrustedRoot.crt)
-----END CERTIFICATE-----
-----BEGIN RSA PRIVATE KEY-----
(certificate Key: eg. your_domain_name.key)
-----END RSA PRIVATE KEY-----

If you have problems generating the complete and correct certificate chain, you can use tools such as https://whatsmychaincert.com/ as an aid.
'''Please keep in mind that you never give away the private part of your key.'''

=== Known issues ===
*The app platform webserver can use only the default http/https ports 80/443.
*By design, there is no possibility to restore the default webserver certificate on the App Platform, if another certificate was once uploaded. 
**If nevertheless needed, you must login with Putty (see [[#How to retrieve files from the AP| Retrieve files]]) and execute these commands as root:
**''psql -d manager -c "DELETE FROM config WHERE name='webserverCertificate'"''
**''/etc/init.d/S92manager restart''
*The app platform webserver interprets URLs case-sensitive. In other words, <nowiki>http://<addr>/file.txt</nowiki> is not the same as <nowiki>http://<addr>/FILE.TXT</nowiki>

== Database ==
The app platform creates a database for each app instance with a given password. In the installer there will be used randomly generated passwords. You can set a new database password for every instance in the Application Platform.

The apps should store all data in that database. That makes sure that a consistent backup and restore of app instances can be done by the app platform manager.
In hosted scenarios, having separate databases for each instance also makes sure that the data of different customers are clearly separated and can easily be moved from one physical platform to another.

The default configuration decline database request from extern. If you need external access you can change the PGSQL configuration (as root) in the file ''/mnt/sda2/pgsql/pg_hba.conf''.
After editing pg_hba.conf, the database-service has to be restarted with the command <code>/etc/init.d/S50postgresql restart</code>
(Please think about it before you do it, because a better way is to create your own local app with local database access.)

You can find the official documentation for the pg_hba.conf here: https://www.postgresql.org/docs/14/auth-pg-hba-conf.html

Please note that you do this on your own responsibility, that it makes sense to create a backup of the original pg_hba.conf
and that you may break your database server if you do not know exactly what you do!

Sometimes the Apps are not proper working after this. You can wait a while until everything is working again or you go the hard way:
* stop the manager
** <code>/etc/init.d/S92manager stop</code>
* restart the database-service (maybe not really necessary, but makes a good feeling)
**<code>/etc/init.d/S50postgresql restart</code>
* start the manager
** <code>/etc/init.d/S92manager start</code>

=== Nightly database analyse ===

Every database is analysed at night to keep indexes in sync with the data. This triggers a ''vacuumdb -a -z'', which updates optimizer statistics, but does '''not''' shrink the physical size of the database. 
This must be done manually in the instance settings.

== App Platform Manager ==
The App Platform Manager is the central component of the App Platform. It does the following:
* Installing app services by downloading the binaries from an app store.
* Running and monitoring app services. If an app service crashes it is restarted, automatically.
* Management of app instances and providing them with the environment they need:
** A database
** A webserver path
** A password for authentication
* Backup and restore of app instances.
* Collecting debug information like tracing and crash dumps.
* System monitoring (CPU usage, memory usage, etc).

== App Services ==
App services are runned by the App Platform Manager. They implement an interface that is used by the manager to start, stop and configure app instances. Each service runs in a separate child process of the manager.

== App Instances ==
The actual functionality of an app service is provided by app instances. They run in the same process as the app service but have a distinct webserver path and their own database. There can be 0..n instances of an app service. Instances can optionally host (web) apps that can be opened in the myApps client.

Each instance of an App service has two passwords. The instance password itself and a database password. If you want to change it you must update the password on both sides. 
The instance password must match to the password in the corresponding PBX App objects, while one instance can have different App objects. 
The database password must be just known to the manager and not outside of the App Platform.

The ''Database name'' and ''Database user'' are both limited to a length of 63 characters. By default, the App Manager would create ''<domain>''_''<instance-name>'' as value for both. This is why it is recommended to use instance names so that length(name) + length(domain) is less than 63 characters. However, if this is not possible, you can manually shorten the suggested values (both must still be unique on your App Platform).

=== Cleanup database ===
You can cleanup the instance database inside the instance settings. This starts the vacuumdb process for the instance database which frees disk space of deleted rows.
Note that this process locks the database and that sufficient disk space is needed to complete it!

=== External database host ===
You can optionally configure an external database host, if the database shall be hosted on an external host. 
Note that the App Platform Manager still creates a local database, which is then not used as long as the external host is configured.

What are external databases useful for?:
* User data is too large (files are stored as BLOB in the database)
* Other (non-innovaphone) database servers are to be used due to other regulations
* There is already an external database cluster with its own backup/restore processes which should be used
* More performance is required (please note that a local UNIX socket provides much faster results than a remote database server). Depending on the app and the task of the app, it can still be useful to use a separate server if it is faster.

==== Supported database types ====
In principle, ''PostgreSQL'' and ''MySQL'' are supported. However, please note that the respective app must be designed for the target database server type. If an app has been developed for PostgreSQL, it cannot be operated on a MySQL server.

'''Please note:''' All innovaphone apps are developed exclusively as PostgreSQL apps.

MySQL therefore only makes sense if own apps are developed and MySQL or certain MySQL features are to be used. For such apps, it is very important to deactivate the automatic Application Platform APP-Backup.
The database backup process of the App Platform uses PostgreSQL backup commands, which is why the backup would fail, so the app must be excluded from the backup, and you must take care of the backup yourself.

==== Database creation ====
If you use an external database, you have to create the database itself.
The App Platform Manager itself creates a PostgreSQL database like this (you may respect this on your database host to be compatible with the database implementation inside the Apps):
* CREATE DATABASE "dbname" ENCODING 'UTF8';
* CREATE USER "dbuser";
* ALTER USER "dbuser" WITH PASSWORD 'dbpassword';
* GRANT ALL PRIVILEGES ON DATABASE "dbname" TO "dbuser";
* ALTER DATABASE "dbname" OWNER TO "dbuser";
* REVOKE CONNECT ON DATABASE "dbname" FROM public;

==== Database connection ====
There are different possibilities to specify the host. You can use a DNS-Name, IPv4 or IPv6. A port can be optionally added with a colon.

Our PostgreSQL implementation sets sslmode=prefer, so SSL is used by default if enabled on the server.

==== Backup/Restore ====
External databases are still backuped as normal, but you can't restore such a database with the App Platform Manager on the external host! You must restore such a dump manually on your database host.

==== Database redundancy ====
In principle, it is possible to create redundancies for failure scenarios through this function.

However, there are different scenarios that need to be evaluated on a case-by-case basis:

* One database, multiple App Platforms (primary online / secondary '''offline''') where multiple apps access the same database.
** This mode of operation is legal as long as you can really ensure that only one App Platform is active at a time.

* One database, multiple App Platforms (primary online / secondary '''online''') with multiple apps accessing the same database.
** This operating mode cannot be used for innovaphone apps, as the app itself would have to be developed for such a mode, which it is not.

However, we advise great caution here! The use of the same databases from different nodes may only be used if you can ensure that the databases or runtime environments of apps cannot get into a ''split-brain'' mode.

== Relationship between app instances and app objects in the PBX ==
Typically an app instance is connected to one or more app objects in a customer PBX. This is done by configuring the same parameters on both sides:
* URL
* Password
The password is used by the PBX for authenticating itself, users and services against the app instance.

Some apps need a websocket connection with the PBX. When "websocket" is activated at the app object, the PBX establishes a websocket connection to the app instance and provides the APIs that are configured at the app object.

=== Supported scenarios ===
It is important to understand that the concept does not do any assumptions on how PBXes and APs are correlated. So you can have
* One App Platform for one customer
* One App Platform for many customers
* Many App Platforms for one customer
* Many App Platforms for many customers

Attention: The V13 installer can only configure the scenario "''One App Platform for one customer''". If you want to have a different scenario, you have to configure it manually.

For hosting or cloud scenarios you need special scenarios. Please refer our [[Howto:V13 Hosting| V13 Hosting]] instructions.

=== Restrictions ===
Currently we don't have redundancy for app instances or App Platforms.

== Update of the App Platform itself ==
The App Platform is build on top of buildroot and will receive updates and fixes from time to time. 
You can update the used build inside the Manager App by using the '''Update''' button at the top. 

It is strongly advised to make a full backup (VM) or at least backup all apps (Gateway) before you run such an update!

After the update has been downloaded and verified, your App Platform will reboot.
You can check the installation process after the reboot with the following URL: https://IP-of-AP/manager/ramdisk.log

== App services and multi-threading ==
Each App Service runs in a single process with no multi-threading, independent of the instances of the App Service. However, each instance maintains its own database connection and the database responds to this connect with the creation of a new process. Each app service therefore uses 1+''n'' threads (where ''n'' is the number of instances). All communication between app service instances and their clients must pass the single-threaded web server. On platforms with multi-threading support (i.e. VMware or Hyper-V), up to 1 + ''m'' + ''m'' * ''n'' (with ''m'' being the number of Apps and ''n'' the number of instances per App) threads can be utilized.

= AP Manager settings =

== General ==
* ''Enable Developer mode'': in developer mode, apps can be manually uploaded without an App Store
* ''Disable App security'': each App has an own unix user and if this flag is set, the user can login with SSH for debugging
* ''App Store URL'': the URL to the App Store where Apps are searched and also an update of the AP image itself
* ''Devices app URL'': the URL to the Devices App to manage the AP through Devices
* ''Devices app URL 2'': don't use!
* ''App Platform DNS name'': currently not used
* ''NTP server 1/2'': NTP servers for this AP (in addition to NTP servers retrieved by DHCP)
* ''Timezone string'': A timezone string which is used by the App Platform Manager to do certain jobs according to the configured timezone.
** Note that this doesn't change the timezone of the linux itself!
* ''DNS server 1/2'': DNS servers for this AP (in addition to DNS servers retrieved by DHCP)
* ''Database optimization time'': The database optimization process will be started at this hour (local time), with a random offset of up to 7 hours
* ''Command file'': see [[#Backup of the Apps| Backup of Apps]]

== Security ==
* ''Current Webserver certificates'': shows the current certificates with the ability to download them.
* ''Webserver certificate'': upload a webserver certificate in PEM format
* ''TLS profile'':
{{TLS_profiles}}
* ''Allow just HTTPs connections'': disable the HTTP port of the webserver and just allows HTTPs connections
* ''AP Manager password'': the password to the web interface of the AP Manager (normally set through Devices)
* ''Linux root user'': password of the root user (normally set through Devices)
* ''Linux admin user'': password of the admin user (normally set through Devices)

== Let's Encrypt ==

Configure the certificate creation by Let's Encrypt here.

* ''Enable'': turns the automatic creation on or off
* ''Let's Encrypt App URL'': the URL of your Connector for Let's Encrypt App Service. You can copy&paste this URL from your Connector for Let's Encrypt PBX Manager Plugin
* ''Let's Encrypt App Password'': the client password of your Connector for Let's Encrypt App Service. You can copy&paste this password from your Connector for Let's Encrypt PBX Manager Plugin
* ''Key length'': 2048, 3072 or 4096 (keep in mind, that [[{{NAMESPACE}}:Certificate_management#Certificate_Key_Length_and_CPU_Usage|a higher value provides higher security but also lower performance!]])
* ''DNS Name'': the external DNS names of your device (up to 100 possible)

== Alarms and events ==
* ''URL'': URL to the Events app
* ''Username/Password'': HTTP credentials of the Events app
* ''Email address'': an email address which will get emails on full disk alarms/warnings
* ''Threshold'': All Apps will be stopped and an hourly email sent on reaching this threshold. An alarm is generated 10% before reaching this threshold and an email is sent every 24 hours.

== SMTP ==
SMTP server settings for sending emails from within the AP Manager.

Starting with 16r1 you also can configure OAuth2 Authentications. You can have a look into our HowTo Article for assistance: [[Howto16r1:Configure OAuth2 E-Mail]]

== Replication ==
App Platform [[#App Platform replication|replication settings]]

== Registered Access Domains ==

== Update ==
Updates the App Platform to the latest image available on the App Store.

== Restart ==
Restarts the App Platform.

== Shutdown ==
Shuts down the App Platform.

= App Platform replication =

== Requirements ==

* 13r3 or above on both standby servers and the primary server
* at least an App Platform image starting with version 110002 (otherwise postgresql is too old)
* standby and primary servers must have the same system architecture
** arm gateways (IPx11) just with arm gateways (IPx11)
** arm64 gateways (IPx13) just with arm64 gateways (IPx13)
** x86_64 virtual machines just with x86_64 virtual machines
* the disk size on standby servers must be at least equal as the disk size on the primary server

== General ==
The configuration is done within the App Platform Manager next to the settings button under "Replication".

=== Off ===
No replication is done at all.

=== Primary ===
The App Platform acts as primary server for one or multiple standby servers. 
Max 8 standby servers can be configured. 
 
Every standby server must get a unique name on the primary server which is then also configured on the standby server itself. This is due to the fact, that the primary server preserves data for every standby server while it's not reachable. 
A standby server name must be a valid domain name, although this name is currently not used as DNS name (but might be used in the future). 
 
The password is randomly pregenerated and must be used as handed by the App Platform Manager.

==== PostgreSQL port ====
The default PostgreSQL port is 5432 and can't be changed on the primary. It must be reachable through your firewall or at least forwarded on a different port towards this App Platform on port 5432.

=== Standby ===
Configure the password from the primary and one of the not yet used standby server names. 
The host and port must be reachable through the network. You can specify a non default port which then must be forwarded somewhere else to port 5432 on your primary.

*Note: Do '''not''' configure the same standby name on different standby servers, as this will break the replication on at least one standby! 
*Note: On a standby, all '''locally installed apps are removed''' during installation

== Failure detection ==

The replication state on both primary and standby servers are continuously monitored. 
In case of a broken connection, an alarm is triggered at once and just cleared if the failure goes away. 
 
If such an alarm lasts for 5 minutes an email is send. The recipient address must be configured in the App Platform Manager settings under "Alarms and Events" and you must also provide a valid SMTP configuration.

== Failover ==

There is no automatic failover procedure. If you detect the failure state, you must get active yourself.

=== Standby down ===

Fix the standby server and see if the replication comes up again. If not, setup a new standby server which will replicate the whole database cluster from scratch.

=== Primary down ===

If the primary is down and cannot be brought into life again, you must take the following steps, depending on your configuration:

==== One standby server ====

* Disable the replication in the replication configuration. You will then have a standalone App Platform afterwards.

==== Multiple standby servers ====

* Change the replication type on one of the standby servers from standby to primary. Please note that the other standby entries must still exist here (they are automatically offered)!
* Change the host entry on the other standby servers to the new standby server. The standby server will sync the whole database cluster again, which will take time.

==== Configuration changes ====

You must also tell the PBXes and other tools to use the new primary server.

* You may simply change the IP address behind the DNS of your primary server to point to the new primary server.
**Note: to ensure rapid recognition of the new DNS target, the definition of an appropriate TTL value is recommended
* Without DNS, you must currently modify the configuration by replacing the IP address of the old primary with the new address.
** This must be done in every master PBX configuration.
** This must be done in every App configuration which may use this IP address, e.g. Devices which rolls out an alarm server configuration

== App Platfom update ==

If you're running an active standby server and the major version of the PostgreSQL database didn't change, you can simply update primary and standby servers independently. 
 
If it contains a ''new major version'' of the PostgreSQL database, you must follow these steps:

* deactivate replication on all standby servers (which promotes these standby servers to active servers)
* ensure that the '''same''' App Platform Manager version is running on primary and standby servers!
* perform the App Platform update on the primary server
* perform the App Platform update on the standby servers
* reactivate replication on the standby servers (which will do a full replication again, so it might take some time)

Alternativly you may setup the standby server from scratch directly with the new App Platform image version.

Sadly there is currently no better method offered by PostgreSQL to perform such an upgrade.

See also https://wiki.innovaphone.com/index.php?title=Howto14r2:Firmware_Upgrade_V14r1_V14r2#App_Platform_and_Apps

== Technical backgrounds ==

=== Streaming replication ===

We use the asynchronous [https://www.postgresql.org/docs/9.3/warm-standby.html#STREAMING-REPLICATION streaming replication of PostgreSQL]. A transaction thus just waits for a commit on the primary server. Standby servers will receive the transaction asynchronously afterwards to avoid a reduced writing performance. 
A primary server keeps the neccessary WAL files for every standby server until the standby fetched the neccessary information. 
This fact can lead to higher disk space usage on the primary if one or multiple standby servers are offline for a while.

Take care to fix broken replications as soon as possible to avoid a full disk on the primary server!

=== What is replicated ===
The whole database cluster of an app platform is replicated. This includes every database of every instance and the database of the App Platform Manager itself. 

=== App Services on standbys ===
The database of the App Platform Manager itself also contains the App service binaries to be able to restore applications in a failover case. 
You do not have to install App services on the standby if you install them on the primary. 
App Platform Manager and Webserver can be updated as usual through the App Store or the Devices App if the standby is connected to Devices.

=== App Platform Manager configuration of the standby server ===
The App Platform Manager configuration of the standby server cannot be stored inside the database, as the database is readonly. So it is stored inside a configuration JSON file under ''/home/root/standby.conf''. 
This configuration is backed up as usual by a Devices backup job and can be also manually restored on a standby (not on a primary though!).

Configuration options from the primary are not synced to the standby server, as the standby server has its own configuration (as it could be in a different network etc.)!

=== No automatic failover ===

There is currently no automatic failover mechanism. PostgreSQL doesn't offer multi master replication, so writing is just possible on the primary itself. Standby servers have a readonly database. 
Let's consider the following use case if we would implement an automatic failover with the current technical possibilities: 
* The primary server is connected to a master PBX.
* A slave PBX is also connected to the primary server in another location.
* A standby server is in this location and replicates from the primary.
* The internet connection between primary and standby fails.
* The standby promotes itself to primary, so that the master PBX now writes to the old primary and the slave PBX now writes to the "new" primary.
* The internet connection comes up again and both primary and standby servers now have databases which are out of sync and which cannot be merged.

=== Security ===

* port 5432 must be reachable on the App Platform
* For every standby a PostgreSQL user is created with the REPLICATION role on the primary. Just this user has access to the database server from non localhost connections.
* You cannot establish a standard connection with such a user and modify/read from tables.
* The replication connection is established over TLS by default.

= App Installer PBX Manager Plugin =
== Requirements ==

* V14 and above

== General ==

The app installer plugin allows IT administrator (with access to the PBX Manager) to install/update/delete new apps from the innovaphone app store including Partners apps. It is automatically available with existing app platforms or after adding a new one in the PBX Manager.
It offers a view to the App Platform Manager‘s App Store with all the available functionalities and simplifies the install, update and uninstall of apps.

== Dedicated AP for each user ==

Installing a new app will install the app service and add a new instance with the user’s domain. The instance is automatically started. 
This further enables the configuration of the instance through its respective PBX Manager plugin. 
Uninstalling the app will remove the app service and the corresponding instance.

== Shared AP between users ==

Installing a new app works in a similar way to that of the dedicated AP. However, each time a new user installs the app, only a new instance is created if the app service is already installed. 
A user can uninstall the app, in this case the corresponding instance is deleted. If no more instances exist, then the app service is uninstalled. 
The administrator can only update the app service in such scenario.

= Known Issues =

== Reboot after an image update hangs (ARM/ARM64 gateway) ==

If it happens, that the App Platform doesn't recover after the reboot, please open the Admin UI of the corresponding gateway and take a look at App Platform -> General. 
If '''Kernel command line''' is set to '''/dev/ram0''', the App Platform booted the ramdisk. 
 
Try to fetch the upgrade log file:
https://[APP-PLATFROM-IP/DNS]/manager/ramdisk.log
 
If this doesn't work, try to login with putty in this case (default credentials admin/ipapps and root/iplinux) and issue this command: 
''cat /apps/install_step1.log'' 
 
If this file contains '''finished''' at the end, you can reconfigure the settings under App Platform -> General: 
* press '''Stop'''
* Initrd file: empty
* Kernel command line:
** IPxx11: '''root=/dev/sda3'''
** IPxx13: '''root=/dev/nvme0n1p3'''
* Ramdisk size: empty
* press '''Start'''

The App Platform should boot and run the already updated image.

<pre style="color: red; font-size:150%;">---WARNING---
If the file doesn't contain "finished" at the end, you may still need to wait, as an upgrade may take some time!
Do not reconfigure without being sure that the upgrade has finished, otherwise your system may won't run!</pre>

== Reboot after an image update boots always into rescue mode (virtual machine) ==

This most likely means that the image installation didn't finish the first time and was interrupted before the bootloader settings could be changed back to the default partition. 
 
If your App Platform doesn't boot or isn't normally accessible after manual selection of the standard entry in the boot menu, you need to '''revert''' to a '''snapshot/backup''' prior to the update. 
If your App Platform runs normally though, you can follow this instruction to change the default boot entry: 
 
* boot into the '''rescue''' partition
* login with root/iplinux
* edit the file /boot/grub/grub.cfg
** search the line with '''set default=0''' and change it to '''set default=1'''
** reboot

== App Platform doesn't start after an update ==

=== Gateway ===
If it happens, that the App Platform doesn't want to start an update, please open the Admin UI of the corresponding gateway and take a look at App Platform -> General. 
* '''Shutdown''' the App Platform and '''Stop''' it 
* Set '''Kernel command line''' to '''/dev/ram0''' 
* Set '''Initrd file''' to '''ramdisk.ext2.xz''' 
* Set '''Ramdisk size''' to '''100000''' 
* '''Start''' the App Platform now. 

The App Platform now either applies the image update or it reboots into the old image. Try the image update afterwards again.

Note: This process can take a while, after it's finished it reboots and automatically change the '''Kernel command line''' value.

=== Virtual Machine ===

Boot into the '''rescue''' partition.

The App Platform now either applies the image update or it reboots into the old image. Try the image update afterwards again.

=== It still doesn't start ===

If it still doesn't start, configure the App Platform to boot from /dev/sda3|IPx11 or /dev/nvme0n1p3|IPx13 (or inside a VM start the second boot loader entry) and login with SSH as root.
Then do a first check to verify that you have a specific error due to an incomplete update or a [[Howto15r1:Firmware Upgrade V14r2 V15r1#AP Upgrade to Image 130006|wrong update order]]:

* /etc/init.d/S92manager stop
* /apps/manager/manager
* if this outputs '''error while loading shared libraries: libcrypto.so.3:''' you have a manager version which cannot run on the current image.

In this case you must download an older build (14r1 1410593):

* /etc/init.d/S92manager stop
* wget --no-check-certificate -O /apps/manager/manager https://webbuild.innovaphone.com/1410593/arm/manager/manager
** inside a virtual machine, use '''x86_64''' inside the path instead of '''arm'''
** on an IP6013, use '''arm64''' inside the path instead of '''arm'''
* wget --no-check-certificate -O /apps/webserver/webserver https://webbuild.innovaphone.com/1410593/arm/webserver/webserver
** inside a virtual machine, use '''x86_64''' inside the path instead of '''arm'''
** on an IP6013, use '''arm64''' inside the path instead of '''arm'''
* chown root:root /apps/manager/manager
* chown root:root /apps/webserver/webserver
* chmod +x /apps/manager/manager
* chmod +x /apps/webserver/webserver
* echo 110000 > /mnt/sda1/label
** this allows the manager to perform an image update again
* /etc/init.d/S92manager start
* now perform an image update and '''afterwards''' update your apps again

== Webserver doesn't respond after an image update ==

If you can't reach the web UI after an image update, please try to connect with SSH as admin user and delete old coredumps, which may prevent the App Platform Manager from starting correctly:
* su root (become root)
* rm -f /mnt/sda2/log/core_dumps/*/*
* /etc/init.d/S92manager restart

Check if you can now reach the App Platform again.

= Tracing =
Each App Service has its own log file, which can be accessed through the Manager App. You can configure a log file size for each App Service. 
Each App Intance has its own trace flags. The following trace flags can be set: 

* Alarm client: used by the manager to send alarms to an alarm server
* App: logs from the App Service itself
* App WebSocket: logs app websocket connections (e.g. from PBX objects to an App Service or from the UI to the App Service)
* AppSharing: just native clients
* AppProxy: just native clients, logs requests which are proxied between the local webserver and the remote server
* Audio: just native clients
* Browser: just native clients
* Command: the command interface is used to execute shell commands, e.g. used by the manager App
* Config: logs config changes of an App
* Database: database logs
* DB files: database file logs
* DNS: DNS request logging
* DTLS: just native clients, DTLS request logging
* Ethernet: interface to get ethernet adapater infos, just manager App
* File: logs for file system access (synchronous), e.g. manager App
* Files: logs for file system access (asynchronous)
* HTTP client: http client logs
* HTTP file: logs for static HTTP files
* ICE: just native clients
* LDS: local domain sockets
* Media: just native clients
* Media channel: just native clients
* Process: IProcess interface logs which is used for spawning, killing processes etc.
* SMTP: SMTP client logs
* TCP: TCP logs
* Time: ITime interface logs
* TLS: TLS logs
* TURN: just native clients
* UDP: UDP logs
* Video: just native clients
* WebSocket client: logs outgoing websocket connections
* Webserver traffic: logs incoming HTTP traffic, which is forwarded from the webserver to the App
* WebDAV service: logs WebDAV requests to the App
* Webserver: enables webserver specific logs

== RPCAP ==

If you open the Manager App, click on the Manager in the left list and then on the Diagnostics button, you can enable RPCAP. 
You can add the interface in wireshark with the string:
rpcap://<APP-Platform-IP>/eth0

'''Please don't forget to disable RPCAP after your testing!'''

== Exclamation marks ==
If you see an exclamation mark next to an App Service, this App Service has been crashed before. 
You can download a core dump or backtraces for further investigation. To clear the exclamation mark, you have to delete the log files.

= How-Tos =

== How to retrieve files from the App Platform ==
To retrieve files from the App Platform which can not be retrieved via the App Platform manager UI, you can connect to the App Platform using the SCP protocol on port 22. 
 
First copy files to /home/admin as root with Putty or another SSH client:
* use the ''DNS'' name or IP address of your App Platform (not the PBX)
* use user ''admin'' and the appropriate password (''ipapps'' by default)
* use ''su root'' to be root (''iplinux'' as default password)
 
You can now copy files to ''/home/admin'' (e.g. from /var/log/apps/manager/...). 
 
You can create a tar archive with all logs like this:
* cd /home/admin
* tar -cf - /var/log/* | xz -z - > log.tar.xz
** you may want to exclude coredumps (due to their size):
** tar -cf - --exclude=/var/log/core_dumps/* /var/log/* | xz -z - > log.tar.xz
* chown admin:admin /home/admin/log.tar.xz
 
Then copy the files to your local system, e.g. with WinSCP 
* use ''SCP'' as protocol (NB: WebDAV is not supported on most of the directories on the App Platform )
* use the ''DNS'' name or IP address of your App Platform (not the PBX)
* use user ''admin'' and the appropriate password (''ipapps'' by default)
* use ''/home/admin'' as start directory
* copy the needed files

== App Platform disk space warning ==

If the configured threshold is reached, all Apps are stopped inside the App Platform . You must then free disk space somehow.

=== Find large instances ===
Click through your apps in the tree on the left side and take a look at the database size of each instance.

=== Delete data inside an instance ===
It depends on the type of app if you can delete data or not. E.g. you can start the Files app and delete files inside this app. 
This won't reclaim disk space though due to the way how PostgreSQL databases work, so you need to follow this guide to reclaim the disk space:

* start the corresponding App
* delete data inside the App
* optimize disk usage of the database by cliking on the button "Clean up database" under Edit instance. If this does not help, continue with the following steps.
* stop the corresponding App again
* download a backup of the instance (backup button at the top), this backup contains the whole instance data, also the password of the instance
* delete this specific instance
* restore the downloaded backup (restore button at the top)

Depending on the hardware and the size of the instance, this process may take hours to complete!

=== Resize the disk ===
The resizing of a disk is just possible for virtual machines, see [[#Resizing the disk of a Virtual machine|Resizing the disk of a Virtual machine]].

=== Delete the whole instance ===
If there is no other possibility, you can delete the whole instance. Afterwards you recreate the instance with the same values and a new random password. Don't forget to set this password in the corresponding PBX App objects though!

=== Restart the Apps or the App Platform ===
If you have enough disk space again, you must either restart the whole App Platform or you manually start all Apps again.

== App Platform/Apps app not online anymore due to full disk ==
If the apps app is not online anymore and you can't access any apps anymore, try to login with an SSH client to see if your disk is full.
Login as admin and afterwards as root (su root). 
 
* issue '''df -h''' and see the disk usage of /dev/sda2, if this is 100%, your disk is too full
* stop the manager
** /etc/init.d/S92manager stop
* empty the 500 MB file, which is exactly for this case here (manager must be 13r1 SR9 or higher to have this file)
** echo "" > /mnt/sda2/empty_if_no_space
* delete log files to recover some space
** rm /var/log/apps/*/*
** rm /var/log/core_dumps/*/*
* restart the postgresql server (see the output if this worked or not)
** /etc/init.d/S50postgresql restart
* restart the manager
** /etc/init.d/S92manager restart
* wait until everything is online again
* open the Apps app and try to find the instance which uses the most disk space and try to delete files/content from it
** you may want to stop all app services first to prevent more writes to the database
** if not possible, you can delete this instance, but you'll loose all data from this instance then!
* after that you can try [[{{NAMESPACE}}:Concept_App_Platform#Shrink_the_physically_size_of_PostgreSQL_database_files|Reference14r2:Concept_App_Platform#Shrink_the_physically_size_of_PostgreSQL_database_files]] to free up space
** If this does not work you can create a backup from the database, delete the database and import the database again.
* free up at least 500 MB so that the manager can create the file again
* delete /mnt/sda2/empty_if_no_space if you are done and restart the manager:
** rm /mnt/sda2/empty_if_no_space
** /etc/init.d/S92manager restart
** the manager restart automatically recreates the empty_if_no_space file if this file doesn't exist

Make sure, that you do '''not''' have backups configured to a local files instance while this files instance is not excluded from backups.
An instance can be excluded from backups in the instance settings in the App Platform Manager.

If all of this doesn't help, you can resize the file system on a VM:
* proceed with [[{{NAMESPACE}}:Concept_App_Platform#Resizing_the_disk_of_a_Virtual_machine|Reference14r2:Concept_App_Platform#Resizing_the_disk_of_a_Virtual_machine]]

== Resizing the disk of a Virtual machine ==

Do '''NOT''' resize if you're running an App Platform version higher than '''110000''' and lower than '''110027''' or '''130007''' and lower than '''130015''' or your data will be lost!
Please update your App Platform to version 130015 or higher before you start resizing your disk.

* stop the VM
* expand the disk using your VM utilities
* start the VM, select in the blue screen the option '''rescue/setup''' (just the first 3 seconds to see)
* login with '''root''' and '''iplinux'''
* execute this command: '''/home/root/install_step1.sh log.txt resize'''
* the VM reboots automatically after a successful resize

== Shrink the physically size of PostgreSQL database files ==
Tuples that are deleted in your database are not physically removed from the database-file. So the claimed space on the harddisk is still in use after the delete operation.
If you need to free up some disk space you can force to reorganize the physically database-file on your harddisk.

You can also start this process through the instance settings as long as the App Platform Manager is still running.

'''Important: You are operating on the Database, you have to make a Backup of your Database before you do this!'''

Login via SSH to the APPlatform with the ''admin'' User
su root

=== All databases ===
/etc/init.d/S92manager stop # not always needed, but in case of database errors recommended, of course no app is online then
sudo -u postgres reindexdb -a
sudo -u postgres vacuumdb -a -f
/etc/init.d/S92manager restart # just execute if the manager has been stopped above

=== single database ===
sudo -u postgres reindexdb -d dbname # for a single database with dbname
sudo -u postgres vacuumdb -d dbname -f # for a single database with dbname

Note: This may take some time and the App database is not available during this time

After the process you can check the free dispace via <code>df -h</code>. You can check the claimed space from the database file with the command <code>du -sh /mnt/sda2/pgsql/</code>.

== Change IP Addresses / DNS Names / System Name ==

If you want to change the System Name or the DNS Name of the PBX and/or App Platform Platform you must change records manually '''in the described order'''!
You have to know the Admin password to directly Login to the App Platform .

=== App Platform ===
; Settings - General
* ''Devices app URL''
* ''App platform DNS name''

; Settings - Alarms and Events
* ''URL''

; All Instances
* ''Domain''
* ''Webserver path''

=== PBX ===
Download the configuration and ''search/replace'' in the config file. Upload the config file and reboot.

Manual:
* ''URL'' in all PBX Object (Apps, Voicemail ...)
* [[{{NAMESPACE}}:Gateway/CDR|CDRx]]
* [[{{NAMESPACE}}:PBX/Config/General|IP address for App Platform]]
* [[{{NAMESPACE}}:PBX/Config/myApps|Reset Password Page]]
* [[{{NAMESPACE}}:PBX/Config/Authentication|Verification link]]

Depending on your change you have to activate/deactivate the Setting [[{{NAMESPACE}}:PBX/Config/General|Operation without DNS]]

=== Additional Devices / Steps ===
* ''Devices Registration URL''
** There is no automatism to change the URL on all devices in your setup.
** If you have the option to use DHCP, you can temporarily overwrite the [[{{NAMESPACE}}:Services/Update|Update URL]] and execute a [[{{NAMESPACE}}:Concept_Update_Server|custom update script]] to change the ''Device Registration URL''
* ''Alarm server''
* Reverse Proxy configuration
* Change ''Domain Name'' in Devices if you have also changed the system name

== How to recover from a broken File System ==
Sometimes you may find messages in the ''messages'' log file (in ''var/log'') like

initial error at 1500329378: ext4_journal_start_sb:328
last error at 1500329378: ext4_journal_start_sb:328

Or you get events like "Broken file system" from your App Platform .

This indicates a file system failure on the Linux Installation.

When the Linux file system is broken, you can try to repair it using some command line Linux tools.

If this doesn't fix your issue, you need to replace the SSD with a new one, re-install the App Platform and any applications and restore your backups.

=== Gateway ===

* Open the WebGUI of the gateway running your LAP and proceed to ''App Platform/General''
** terminate Linux (''Status/Stop'')
** modify the Kernel command line from root=/dev/sda3 (or /dev/nvme0n1p3) to root=/dev/ram0
** modify the Initrd file to ramdisk.ext2.xz
** modify the ramdisk size to 100000
** start Linux again
:: This will run Linux on another (hopefully sane) partition.

* use [https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html putty] to log in to the LAP's command line ( try either user: root, pw: iplinux '''OR''' user: admin, pw: ipapps)
** use this to be root <code>su - root</code> (password iplinux)
** on the command prompt, use <code>e2fsck -p -f /dev/sda2</code> on IPx10/IPx11 gateways
** on the command prompt, use <code>e2fsck -p -f /dev/sda3</code> on IPx10/IPx11 gateways
** on the command prompt, use <code>e2fsck -p -f /dev/nvme0n1p2</code> on IPx13 gateways
** on the command prompt, use <code>e2fsck -p -f /dev/nvme0n1p3</code> on IPx13 gateways
:: this should fix any issue on the file system

* go back to the WebGUI of the gateway running your LAP and proceed to ''App Platform/General''
** terminate Linux (''Status/Stop'')
** modify the ''Kernel command line'' from ''root=/dev/ram0'' to <code>root=/dev/sda3</code> (IPx10/IPx11) or to <code>root=/dev/nvme0n1p3</code> (IPx13)
** clear the Initrd file field
** clear the ramdisk size field
** start Linux again
:: This will run Linux on the original partition.

=== VM ===

Restart the VM and select the first entry in the boot menu from grub.

* use [https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html putty] to log in to the LAP's command line ( try either user: root, pw: iplinux '''OR''' user: admin, pw: ipapps)
** use this to be root <code>su - root</code> (password iplinux)
** on the command prompt, use <code>e2fsck -p -f /dev/sda2</code>
** on the command prompt, use <code>e2fsck -p -f /dev/sda3</code>
:: this should fix any issue on the file system
* Reboot your VM
[[Category:Concept]]

== How to create a memory dump of a running process ==

Sometimes it's usefull to have a memory dump of a running process to investigate certain issues.

* login with SSH and become root
* find out the PID of the relevant process, e.g. with ''ps aux | grep /apps/manager/manager | grep -v grep''
* gdb --pid PID -ex gcore --batch
* this creates a core file core.PID
* download this core file with WinSCP or similar tools

== Move instance database to external database host ==

In case you want to use an external database server instead of the integrated:

* download a backup of the specific instance over the App Platform Manager
* create a postgresql database on the external host:
** createdb --encoding=UTF-8 exampledb
* restore the backup
** pg_restore -d exampledb backup-exampledb.dump
* change the ownership to a specific postgresql user (which you have to create yourself first)
** psql -d postgres -c "ALTER DATABASE exampledb OWNER TO exampleuser"
* configure the database host, name, user and password on the instance inside the App Platform Manager

Howto:Security works with innovaphone

2026-08-10T13:10:38Z

Vsc: /* TLS */

==Applies To==

* all innovaphone devices

==More Information==
Security issues in VoIP installations become more and more important to customers. While innovaphone very early has implemented a security framework based on the H.235 standard for H.323 supporting authentication and message integrity, the need for encryption to enforce privacy more and more emerges as a requirement.

This paper discusses the existing mechanisms in the version 6,7,8 and 9 release.

==Risks==

Voice over IP applications are like all other data applications exposed to a number of security threats.

These threats can be categorized as follows

• Availability

• Privacy

• Integrity

• Authenticity

• Accountability

===Availability===
As all devices attached to a network, VoIP devices may be subject to attacks against the availability of their offered services.

Such so-called Denial of Service Attacks may be attempted using various strategies, including amongst others exploiting weaknesses of the implementation or legal but excessive use of offered resources.

===Privacy===
As with all communication systems, VoIP devices may be misused to disclose confidential information. With telephone systems, this obviously involves unauthorized access to voice conversations. Moreover, access to configuration data (such as registration accounts, passwords, and extension numbers) can be of interest to attackers as well as call data (such as time and source/destination of calls). Call fraud or so called [[Howto:Protection against Brute Force Attacks | brute force attacks]] are very common these days.

===Integrity===
The integrity of call signalling data as well as of the voice communication itself can be of utmost importance. Spoofing of calling party ids for example may be used to obtain unaccounted access to particular resources (such as long distance calls or special services). But also more subtle and non-obvious tampering with call signalling data like faking cause codes (signalling busy when the party in fact does not respond) etc. or silently changing a call destination may cause severe harm.

==Security Features implemented in Version 6==

innovaphone products today feature a number of security features.

This article provides a rundown of the essential features and how they are enabled.

===Securing Configuration Data===
All configurations for innovaphone devices are stored in local flash memory.

While access to the data through normal interfaces is password protected, the content can potentially be examined if an attacker has physical access to the device (this would require disassembly of the device and examination of the flash EPROM).

Whenever you pass a configured device to someone else (e.g. when selling it), you should keep this in mind. If this is a concern, erase the data before (see related articles below). Configuration data can be dumped to text format using the “Config show” command.

From version 5 on, the resulting text file does not contain any clear-text passwords. Still, remaining configuration information may be considered sensitive. So be careful when providing this information to 3rd parties.

Because passwords are encrypted in the config file, you will need to remember the admin password of the device being dumped in order to load it to another device later on.

===Securing Access to Configuration Data===
innovaphone devices are configured through a web based interface using HTTP or HTTPS access.

===HTTP===
For HTTP authentication, both basic authentication (which is not encrypted) as well as digest authentication is available. You should make sure the browser you are using supports digest authentication which allows for reasonable security against password snooping and man-in-the-middle attacks. There is an option to enforce digest authentication in the “General Settings” (in other words, to disable basic authentication).

However, since the PBX’s SOAP interface is based on HTTP too, all SOAP clients not supporting digest authentication (and the TAPI driver currently is such a client) would be disabled using this option.

innovaphone devices feature non-protected access to the devices home page.

This is convenient; however, it may reveal some critical information to random port scanners targeting a device from the Internet. You may thus choose to password protect even the home page using an option in the “General Settings” area.

By default, all HTTP clients can gain access to the device configuration provided they have the right password. However, there is an option to restrict HTTP access generally to a particular host or network. This option allows you to restrict all HTTP access (and thus administrative access too) e.g. to hosts from within your own LAN.

If remote configuration access is required though (which would be disabled by this setting), you may consider to setup an administrative PPTP (or PPP over ISDN) dial-in access to the device. Many innovaphone devices do support such kind of dial-in out of the box. You would then use the “assign remote IP address” option and assign a local ip address to the dial-in client. This way, remote configuration is still possible and additionally secured by the PPTP encryption layer.

Due to the computational overhead of HTTPS, HTTP payload traffic is not encrypted in innovaphone devices. If payload encryption is critical to you for administration access, make sure you configure an encrypted PPTP dial-in access for configuration as described above.

There is a legacy, telnet based access to the configuration layer. Telnet is inherently unsafe since it transfers unencrypted passwords. It is not recommended to use this. From build 04-5807 on, telnet access is disabled by default. Previous builds can disable telnet access by specifying “/port 0” on the TELNET0 config file line.

===HTTPS===
HTTPS is supported in the since Version 6 Service Release 2 (V6 SR2). RFC 2818 defines use of TLS (Transport Level Security, RFC 2246) to secure the HTTP protocol.

===Managing Accounts===
All administrative functions are secured by account names and passwords. It is strongly recommended neither to keep the default account nor the default password setting.

===Access to VoIP resources===
Access to VoIP resources (such as gatekeeper registrations and access to trunk lines) can be secured by account and password. If securing VoIP resources is an issue, make sure that all gatekeeper accounts are secured by a password. You may even want to consider disallowing any registration without password, even from within the local area network. This can be done in the “general settings” area of the PBX.

To protect your trunk lines from unintended access, make sure to configure all gateways (GWxx entries) properly. For gatekeeper type entries, make sure there is a password, for gateway type entries, make sure the configured netmask suits your needs. Double check all routing entries to avoid unintended access e.g. to trunk lines.

===PPP and PPTP===
When using built-in dial-in (PPP, PPTP) interfaces, PAP, CHAP, MS-CHAPv1 and Ms-CHAPv2 are supported. PAP by design does not allow for password encryption and is thus not recommended. The CHAP variations do support password encryption using MD4 and DES and are therefore reasonably secure.

There is no payload encryption available for PPP (that is, PPP over ISDN) and PPPoE (i.e. xDSL). However, using ISDN dialup, payload encryption is not really an issue.

PPTP however features powerful payload encryption in addition to password encryption. It is using SHA-1 for session key encryption and RC4 up to 128bit for payload encryption. If payload encryption is an issue to you, you should check the “enable encryption” flag in the PPTP configuration. Keep in mind that payload encryption incurs computational overhead and the number of concurrent PPTP session the device can handle is reduced. Using PPTP is an option if fully payload encrypted configuration access is a requirement (see above).

===RAS Registrations===
H323 user account passwords are obviously sensitive information. innovaphone devices feature RAS RegistrationRequest (RRQ) password encryption based on the H.235 standard (H.235v2 Annex D – Baseline Security Profile). By requiring knowledge of a shared secret on both ends, mutual authentication is provided by this mechanism.

===H.225 Signalling===
Based on the H.235 authentication (see above), H.225 signalling messages carry a signature which ensure message integrity in both directions. While message content may still be looked at and thus possibly sensitive information may be disclosed, this mechanism effectively disallows corruption of call, authentication and accounting data and renders man-in-the-middle attacks ineffective.

===RTP===
RTP (i.e. media stream) traffic is not encrypted with Version 6. However, media stream endpoints are negotiated securely (see above), so that content spoofing is made difficult.

===SIP message security===
The current SIP implementation features mutual digest authentication and a reasonable protection against spoofed identities, there is currently no message digest signature available in SIP messages. The integrity of SIP messages thus is not ensured as is the integrity of H.225 and RAS messages (see above).

===SOAP Client account===
SOAP clients (such as the TAPI driver or the Operator) require an account/password for authentication at the HTTP layer. Although the devices admin account can be used for that, it is better practice to use the PBX user password for this. For the HTTP credentials, you can use the PBX users “Name” as account and it’s “Password” as the password. You will use the “Long Name” as SOAP access user name.

When configuring the TAPI driver e.g., you would create a user with Long Name _TAPI_, Name tapi and a password. You would then use tapi/password as Gateway Platform Access/Account/Password and _TAPI_ as PBX Access/Username.

===SNMP===
SNMP is only for monitoring and does not allow any configuration changes. You may want to restrict the list of “accepted hosts” using the gateway applets SNMP area. You may want to change the “community” to a non-standard value.

===ISDN data calls===
ISDN data calls are accepted by innovaphone devices as voice calls are and they are routed similarly. Although innovaphone devices may be configured to terminate a data call and thus access the local network via dial-in, this option must be explicitly enabled.

===Denial of Service attacks===
Like any other network device, innovaphone devices may be a target for a denial of service attack. It is therefore recommended, to protect against malicious access using standard firewall techniques. However, innovaphone devices feature a built-in DoS filter which will discard unreasonable inbound traffic. Also, it is based on a dedicated and proprietary operating system which is usually not a target for viruses and other malicious code.

===Arp Spoofing===
Tools performing VoIP privacy attacks have been made publicly available in order to tap in to VoIP conversations in a local area network. These attacks are based on spoofing layer 2 networks addresses to create a man-in-the-middle scenario where a conversation can be recorded without service interruption to the original participants.

Basically, the attack is based on the fact that the mapping between IP addresses and Layer2 (MAC) addresses is usually built on-the-fly using a protocol (ARP) that has no security built in. Attackers can change this association without notice and thus redirect any traffic to themselves. These kind of attacks have been addressed in V6.

innovaphone ARP stacks will reject unexpected changes to the address mapping, and furthermore cease any traffic to the poisened mac address for 5 seconds. This feature needs to be enabled [[Reference7:Configuration/ETH/IP]] with ''Check ARP''.

This way, an Arp spoofing attempt will be seen as service interruption by the end users, giving the network administrator a chance to investigate.

===Availability===
innovaphone devices have proved to be very robust and reliable. However, if availability is of utmost importance, redundancy options are available which allow for outstanding protection against loss of service.

Also, all innovaphone devices may be powered via power over Ethernet (PoE) which when combined with an uninterrupted power supply (UPS) ensure seamless operation even in the case of a local power failure.

PoE may be used concurrently with a local power supply.

==Additional Security Features in Version 7==
Although at present there are a number of security features implemented in innovaphone VoIP devices, there is still a lack of protection for the privacy of communications. This reflects the fact that previously, the source of attacks usually was expected to be outside of the own organization.

Such risks have been defended using sophisticated firewalls and VPN appliances on the own network border which provide for encryption and thus privacy protection. However, today’s security risks are more and more expected to emerge from within the organization.

The inability of contemporary local area network equipment to provide for encryption and thus privacy of communications puts the burden on the application. VoIP application as well as other data applications must provide for end-to-end encryption.

The V7 introduces a number of features which help to defend against the risks of security attacks.

===SRTP===
Secure RTP is a security mechanism defined by RFC 3711. SRTP can be used for voice encryption with H.323 and SIP.
SRTP encrypts the RTP stream with AES. As a result the key will be chosen randomly on both sites and sent with the signaling data.

Only if both sites have activated encryption SRTP is used.

SRTP can not be forced.

innovaphone supports with Version 7:

*AES-128
*AES-192
*AES-256

all with 32 or 80 bit SHA1 hashed message authentication codes (HMAC).

====SRTP Interoperability====
No interop problems are to be expected if other vendor device offers exactly one of the above crypto suites. Innovaphone equiment will always adapt to the offered crypto suite.

Problems will araise if other vendor device offers multiple crypto suites during call establishment.
In this case all innovaphone devices must be configured to that crypto suite, which is offered at first position.

===TLS===
The TLS protocol obsoletes SSL and allows applications to communicate across a network in a way designed to prevent eavesdropping, tampering, and message forgery. TLS provides endpoint authentication and communications privacy over the Internet using cryptography.

Typically, only the server is authenticated (i.e., its identity is ensured) while the client remains unauthenticated; this means that the end user (whether an individual or an application, such as a Web browser) can be sure with whom they are communicating. The next level of security—in which both ends of the ''conversation'' are sure with whom they are communicating—is known as mutual authentication. Mutual authentication requires public key infrastructure (PKI) deployment to clients.

TLS is needed for
* HTTPS
* secure SIP (SIPS)

innovaphone supports TLS with the following methods:

* RSA with 3DES
* RSA with AES-128
* RSA with AES-256

all with SHA1 hashes.

===H.235===
We currently use H.235v2 Annex D – Baseline Security Profile. It relies on symmetric techniques and provides authentication and/or message integrity based on shared secrets. H.235v3 Annex G – SRTP & MIKEY usage discusses a key management scheme suitable for use of SRTP (RFC 3711).

As SRTP does not specify a key management scheme by itself, the MSEC working group within the IETF discusses key management solutions and currently favours MIKEY. MIKEY defines AES as mandatory transport encryption enforces the use of X.509v3 certificates for public key encryption and digital signatures.

innovaphone implemented H.235 key Exchange for SRTP in Version 7.

===SIPS===
SIPS is SIP over TLS, which is mandated for proxies, redirect servers and registrars by RFC 3261. However, use of TLS requires a secure transport protocol, i.e. TCP.

The mechanisms supported are: TLS, HTTP Digest.

SIPS is supported since version 7.

===Telnet===
The secure shell protocol as per RFC 4251 can be used to apply content encryption to telnet sessions. We will not implement secure shell as we do not recommended to use Telnet at all, and telnet access is disabled by default.

===LDAP===
LDAP uses the SASL security as per RFC 2222. Unfortunately, this does not account for content encryption. LDAP v3 thus has defined extension for use of TLS with LDAP (in RFC 2830).

With Version 9 innovaphone will support LDAP via TLS

===SNMP===
SNMP versions 1 and 2 have been considered “insecure”. SNMP Version 3 includes considerably enhanced security mechanisms (as per RFC 3414). Unfortunately, this puts some difficult burden on SNMP implementations resulting in a rather little deployment compared to SNMP V2. There will be no SNMP security implementation on innovaphone side, as it is read only on the devices.

===802.1X port security===
Port security secures physical ports by enforcing a user authentication before allowing data transfer through a given Ethernet switch port. The endpoint needs to perform this authentication in order to be able to communicate.

As VoIP telephones usually work as an Ethernet switch (featuring a second “PC port”) they would need to enforce port security on this second port too in order not to compromise the security setup. The switch implementation must support multiple authentications on one port.

innovaphone supports the 802.1x feature on all products.

===X.509 Certificates===
Cryptographic certificates assign a public key to an identity. This is needed for the authentication of communication endpoints. The X.509 standard defines one commonly used format for such certificates.

innovaphone supports management functionality for both trusted CA certificates and device certificates / private keys.

We use X.509v3.

==Additional Security Features in Version 8==

===Kerberos based Authentication ===

A single innovaphone device can act as an authentication server for all other innovaphone devices. User accounts that are managed on the authentication server can be used to login on each device in the installation. You can also configure devices to accept user accounts from a PBX (full admin rights) or a Windows domain.

===IP Filter===

Separate IP filter for log-ins with password and without password.

==Additional Security Features in Version 9==

===Object Device===

*In case of registrations to a PBX using incorrect passwords, all other registrations to the relevant object are blocked for 20secs ([[Reference9:PBX/Objects#Security_issues | ''Security issues'' in PBX/Objects]]).

*It is possible to define at the object (for each [[Reference9:PBX/Objects#Devices | device ]]) that the admin password is needed to log in.

*It is possible to delete all [[Reference9:PBX/Objects#Devices |devices ]] at an object and thus completely deny any registration.

===HTTP Access Filter ===

Support for multiple networks in IP filter for the HTTP server (administration).

=== Unknown registrations===

It is possible to use the admin password for unknown registrations (deployment of new endpoints).

=== Voicemail===

The innovaphone voicemail supports SRTP via H.323 or SIPS.

===LDAP via TLS===

With version 9 innovaphone supports LDAP via TLS, for LDAP replication between master/slave/standby/standby-slave PBX.

==Additional Security Features in Version 10==

===TLS===

From v10sr8 certificates with SHA2 signatures are accepted. The new supported signature algorithms are SHA256, SHA384 and SHA512 with RSA encryption.

=== SIP Blacklist ===
Introduced in v10sr9. The SIP stack maintains an automated blacklist. When a REGISTER message is received for either a non-existing user or for an existing user but with a wrong password, the messages source IP address is put on a blacklist for at least 20s. SIP messages received from IP addresses in the blacklist are ignored.

==Additional Security Features in Version 11==

===H.460.17===

Endpoints can now register using H323/TLS. Device certificates can be used for authenticating registrations.

===TLS===

From version 11 TLS protocol version 1.1 and renegotiation (RFC 5746) is supported.

Support for certificates with SHA2 signatures (SHA224, SHA256, SHA384, SHA512).

===DTLS-SRTP===

Up to version 10 SDES was used for the exchange of SRTP keys between endpoints. This means the SRTP key is transported hop-to-hop inside signalling.

From version 11 DTLS-SRTP (RFC 5764) is available as an additional key exchange method. DTLS-SRTP uses end-to-end encryption and is done inband in the media stream. This means that the PBXes and proxies that forward signalling messages can not see the SRTP key. As a drawback, DTLS-SRTP adds a delay at the begin of calls.

DTLS-SRTP supports negotiation of the following SRTP cipher suites:
* AES-128 with 32-bit SHA1 HMAC
* AES-128 with 80-bit SHA1 HMAC

See also: [[Reference13r3:Concept_DTLS-SRTP]]

===Session border controller - SBC===
The Session Border Controller provides the session border functionality, which is that a device can register to an session border object and the session border object establishes the registration to a configured PBX. This can be used when for example the device is located within the public internet and the PBX in a private network.

===Disable NetBIOS===
You can disable the NetBIOS NameServer Feature in the [[Reference11r2:IP4/ETH/DHCP|DHCP Server]] configuration for a specific interface.

==Additional Security Features in Version 12==

===TLS===

From version 12r1 we support the following cipher suites. The DHE and ECDHE suites provide perfect forward secrecy.

* TLS_RSA_WITH_AES_128_CBC_SHA
* TLS_RSA_WITH_AES_256_CBC_SHA
* TLS_DHE_RSA_WITH_AES_128_CBC_SHA (new)
* TLS_DHE_RSA_WITH_AES_256_CBC_SHA (new)
* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA (new)
* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA (new)

The following cipher suites have been deactivated and are no longer in use.

* TLS_RSA_WITH_3DES_EDE_CBC_SHA (deactivated)

==Additional Security Features in Version 13r1 ==
===TLS===

'''Note: With 13r1 SR35 we merged-back the TLS functionality from 13r2. So the feature set is identical with the lastest versions.'''

Supported TLS versions:

* TLS 1.0
* TLS 1.1
* TLS 1.2 (new)
* DTLS 1.0
* DTLS 1.2 (new)

Supported ciphers in version 13r1:

* TLS_RSA_WITH_AES_128_CBC_SHA
* TLS_RSA_WITH_AES_256_CBC_SHA
* TLS_DHE_RSA_WITH_AES_128_CBC_SHA
* TLS_DHE_RSA_WITH_AES_256_CBC_SHA
* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
* TLS_RSA_WITH_AES_128_CBC_SHA256 (new)
* TLS_RSA_WITH_AES_256_CBC_SHA256 (new)
* TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 (new)
* TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 (new)
* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (new)
* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (new)
* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (DTLS only)
* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (DTLS only)
* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (new, DTLS only)
* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (new, DTLS only)

TLS_RSA_WITH_3DES_EDE_CBC_SHA was finally removed and can't be activated in v13r1.

Additionaly we added the configuration of TLS profiles. They can be used to configure the selection and priority of used TLS versions and ciphers.

{|
!style="text-align:left;width:100px;"|Cipher suite
!style="width:100px"|TLS (normal)
!style="width:100px"|TLS (fast)
!style="width:100px"|TLS (secure)
!style="width:100px"|DTLS
|-
|TLS_RSA_WITH_AES_128_CBC_SHA
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_RSA_WITH_AES_256_CBC_SHA
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_RSA_WITH_AES_128_CBC_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_RSA_WITH_AES_256_CBC_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_DHE_RSA_WITH_AES_128_CBC_SHA
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_DHE_RSA_WITH_AES_256_CBC_SHA
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|}

===Random numbers===
For creating private keys for certificates and certificate request, we now use the HMAC-DBRG random number generator based on HMAC-SHA512.

===STARTTLS in SMTP client===
The SMTP client in the firmware and on the app platform now implements STARTTLS for encrypted communication with mail servers.

===myApps Password policy===
{{myApps Password Policy}}

==Additional Security Features in Version 13r2 ==
===TLS===
Supported TLS versions:

* TLS 1.0
* TLS 1.1
* TLS 1.2
* DTLS 1.0
* DTLS 1.2

Supported ciphers in version 13r2:

* TLS_RSA_WITH_AES_128_CBC_SHA
* TLS_RSA_WITH_AES_256_CBC_SHA
* TLS_DHE_RSA_WITH_AES_128_CBC_SHA
* TLS_DHE_RSA_WITH_AES_256_CBC_SHA
* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
* TLS_RSA_WITH_AES_128_CBC_SHA256
* TLS_RSA_WITH_AES_256_CBC_SHA256
* TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
* TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
* TLS_RSA_WITH_AES_128_GCM_SHA256 (new)
* TLS_RSA_WITH_AES_256_GCM_SHA384 (new)
* TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (new)
* TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (new)
* TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (new)
* TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (new)
* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (DTLS only)
* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (DTLS only)
* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (DTLS only)
* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (DTLS only)
* TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (new, DTLS only)
* TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (new, DTLS only)

Major changes in 13r2:
* Added support for GCM cipher suites
* Removed SHA cipher suites from profile "secure"
* Added a new profile "strict"

{|
!style="text-align:left;width:100px;"|Cipher suite
!style="width:100px"|TLS (normal)
!style="width:100px"|TLS (fast)
!style="width:100px"|TLS (high security)
!style="width:100px"|TLS (strict)
!style="width:100px"|DTLS
|-
|TLS_RSA_WITH_AES_128_CBC_SHA
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_RSA_WITH_AES_256_CBC_SHA
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_RSA_WITH_AES_128_CBC_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_RSA_WITH_AES_256_CBC_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_DHE_RSA_WITH_AES_128_CBC_SHA
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_DHE_RSA_WITH_AES_256_CBC_SHA
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_RSA_WITH_AES_128_GCM_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_RSA_WITH_AES_256_GCM_SHA384
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|}

The following TLS versions are activated in the corresponding profiles:

{|
!style="text-align:left;width:100px;"|Version
!style="width:100px"|TLS (normal)
!style="width:100px"|TLS (fast)
!style="width:100px"|TLS (high security)
!style="width:100px"|TLS (strict)
!style="width:100px"|DTLS
|-
|1.2
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|1.1
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|N/A
|-
|1.0
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|}

===myApps brute force protection===
Attackers trying to guess user passwords are blocked by temporarily [[Reference13r3:Concept_myApps#Brute_force_protection|preventing login attempts for an increasing amount of time and generation of events to notify the administrator]].

===IPv4: prevent direct routing between interfaces (since V13r2sr16) ===

Incoming frames directed to another interface are passed directly to this interface by default.
When "IP4/General/Settings/Isolate Interfaces" in the advanced GUI is checked such frames are dropped and the SNMP counter IPROUTINGDISCARDS is incremented.

The corresponding flag can also be set with
!config add IP0 /isolate-interfaces
!config write

==Additional Security Features in Version 13r3 ==
===TLS===
Supported TLS versions:

* TLS 1.0
* TLS 1.1
* TLS 1.2
* TLS 1.3 (new)
* DTLS 1.0
* DTLS 1.2

Supported ciphers in version 13r3:

* TLS_RSA_WITH_AES_128_CBC_SHA
* TLS_RSA_WITH_AES_256_CBC_SHA
* TLS_DHE_RSA_WITH_AES_128_CBC_SHA
* TLS_DHE_RSA_WITH_AES_256_CBC_SHA
* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
* TLS_RSA_WITH_AES_128_CBC_SHA256
* TLS_RSA_WITH_AES_256_CBC_SHA256
* TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
* TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
* TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
* TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
* TLS_RSA_WITH_AES_128_GCM_SHA256
* TLS_RSA_WITH_AES_256_GCM_SHA384
* TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
* TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
* TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
* TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA (DTLS only)
* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA (DTLS only)
* TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 (DTLS only)
* TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 (DTLS only)
* TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (DTLS only)
* TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (DTLS only)
* TLS_AES_128_GCM_SHA256 (new, TLS 1.3 only)
* TLS_AES_256_GCM_SHA384 (new, TLS 1.3 only)

Major changes in 13r3:
* Added support for TLS 1.3
* Added a new profile "experimental" used for testing of new features. The configuration of that profile is subject to change without notice. So it should not be used for productive environments.
* Removed ciphers TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 and TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 from "strict" profile.

{|
!style="text-align:left;width:100px;"|Cipher suite
!style="width:100px"|TLS (normal)
!style="width:100px"|TLS (fast)
!style="width:100px"|TLS (high security)
!style="width:100px"|TLS (strict)
!style="width:100px"|TLS (experimental)
!style="width:100px"|DTLS
|-
|TLS_RSA_WITH_AES_128_CBC_SHA
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_RSA_WITH_AES_256_CBC_SHA
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_RSA_WITH_AES_128_CBC_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_RSA_WITH_AES_256_CBC_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_DHE_RSA_WITH_AES_128_CBC_SHA
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_DHE_RSA_WITH_AES_256_CBC_SHA
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_RSA_WITH_AES_128_GCM_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_RSA_WITH_AES_256_GCM_SHA384
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_AES_128_GCM_SHA256 (TLS 1.3)
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|-
|TLS_AES_256_GCM_SHA384 (TLS 1.3)
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|}

The following TLS versions are activated in the corresponding profiles:

{|
!style="text-align:left;width:100px;"|Version
!style="width:100px"|TLS (normal)
!style="width:100px"|TLS (fast)
!style="width:100px"|TLS (high security)
!style="width:100px"|TLS (strict)
!style="width:100px"|TLS (experimental)
!style="width:100px"|DTLS
|-
|1.3
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|-
|1.2
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|1.1
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|N/A
|-
|1.0
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|}
=== X.509 certificates ===
13r3 Service Release 10 adds support for additional signature schemes in X.509 certificates with RSA keys:
* sha256WithRSASSAPSS
* sha384WithRSASAAPSS
* sha512WithRSASSAPSS
all with mgf1 as mask generation function.

==Additional Security Features in Version 16r1 ==
===X.509 certificates===
Version 16r1 adds support for ECDSA certificates based on the secp256r1, secp384r1 and secp521r1 elliptic curves.

===TLS===
Major changes in 16r1:
* Added support for ECDSA certificates and cipher suites
* DTLS 1.0 has been removed.
* DHE cipher suites have been removed.
* Consolidation of TLS profiles. We now have three profiles:
{{TLS_profiles}}

Supported TLS versions:
{|
!style="text-align:left;width:100px;"|Version
!style="width:100px"|Profile legacy
!style="width:100px"|Profile normal
!style="width:100px"|Profile strict
!style="width:100px"|DTLS
|-
|1.3
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|-
|1.2
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|1.1
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|-
|1.0
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|}

Supported cipher suites:
{|
!style="text-align:left;width:100px;"|Cipher suite
!style="width:100px"|Profile legacy
!style="width:100px"|Profile normal
!style="width:100px"|Profile strict
!style="width:100px"|TLS 1.0
!style="width:100px"|TLS 1.1
!style="width:100px"|TLS 1.2
!style="width:100px"|TLS 1.3
!style="width:100px"|Perfect forward secrecy
!style="width:100px"|AEAD
|-
|TLS_AES_256_GCM_SHA384

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_AES_128_GCM_SHA256

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|-
|TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|-
|TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|-
|TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|-
|TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|-
|TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA

|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|-
|TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA

|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|-
|TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA

|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|-
|TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA

|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|-
|TLS_RSA_WITH_AES_256_GCM_SHA384

|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_RSA_WITH_AES_128_GCM_SHA256

|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|-
|TLS_RSA_WITH_AES_256_CBC_SHA256

|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|-
|TLS_RSA_WITH_AES_128_CBC_SHA256

|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|-
|TLS_RSA_WITH_AES_256_CBC_SHA

|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|-
|TLS_RSA_WITH_AES_128_CBC_SHA

|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:green;text-align:center"|✔
|style="color:red;text-align:center;font-weight:bold;"|X

|style="color:red;text-align:center;font-weight:bold;"|X
|style="color:red;text-align:center;font-weight:bold;"|X
|}

Supported signature schemes:
* sha256WithECDSA
* sha384WithECDSA
* sha512WithECDSA
* sha256WithRSAEncryption
* sha384WithRSAEncryption
* sha512WithRSAEncryption
* sha256WithRSAPSSRSAE
* sha384WithRSAPSSRSAE

Supported mask generation functions for RSASSA-PSS:
* mgf1

Supported elliptic curves for ECDSA:
* secp256r1
* secp384r1
* secp521r1

== Session Riding / "Cross-Site-Request-Forgery"==

For safe administration, see [[Howto:Protection against "Cross-Site-Request-Forgery"]].

== IP Phone USB Interfaces ==
Some of the innovaphone hardware phones feature a USB host interface which supports connection of USB headsets (a.k.a. audio and HID devices) and proprietary innovaphone extension modules. No other device types are supported or recognized.

Like all innovaphone devices, the phones run a proprietary operating system (think of it as ''the innovaphone OS''). It has been written from the ground by innovaphone and is not based on any existing operating system such as Windows, Linux or VxWorks. As such, it does not allow execution of any code (e.g. drivers) derived from such systems. Also, the operating system does not allow execution of user code (that is, code that has been crafted by a user and is not integral part of the operating system). Execution of malware is not possible thus.

All headset drivers are entirely written by innovaphone too. No 3rd party code (such as vendor SDKs) are used.

From V12r1 SR14, you have the option to disable the USB port(s) altogether. Also, you can limit its use to audio or HID devices. See [[Reference12r1:Phone/Protect]] for details.

From V12r2 SR21, you can request informations about the connected USB Device via ''!mod cmd USB-HOST port''
<info><port type="hub" port="1"/><port type="device" port="4" vendor="0xb0e" product="0x245d" release="0x118" product_name="Jabra Link 370"/></info>

In addition, a syslog entry is generated.
20190103-140636 USB-DEVICE plugged: vendor=1395 'Sennheiser' product=0051 'Sennheiser USB-ED CC 01' release=0603
20190103-140637 USB-DEVICE unplugged: vendor=1395 'Sennheiser' product=0051 'Sennheiser USB-ED CC 01' release=0603

== DECT Handsets and IP-DECT ==
The current DECT infrastructure components based on the base stations IP1202 and DECT handsets IP64/IP65 are supporting the Enhanced DECT Security (ETSI TS 102 841, GAP.N.35). Starting with version 2.1.4 of the DECT handset firmware also Step B of the DECT Security Roadmap by DECT Forum was implemented, supporting DECT Standard Authentication Algorithm 2 (DSAA2) based on 128 bit AES encryption, which also implies DECT Standard Ciphering Algorithm (DSCA) based on 64 bit DECT encryption with rekeying interval of 60 seconds.

==Conclusion==
Given the fact that today’s IT managers consider threats originating from inside the organisation as (at least) as critical as those originating externally, the only viable solution is a combination of media stream and signalling encryption performed directly by the endpoints.

Fortunately, both relevant signalling protocols in the PBX environment (H.323 and SIP) seem to converge as far as the media stream encryption (SRTP) and the key management are concerned. This should ensure end-to-end compatibility between SIP and H.323 endpoints. The necessary definitions for use of SRTP with H.323 are part of H.235-Annex G, for SIP it is SIPS - SIP via TCP and TLS.
innovaphone has implemented SRTP according to H.235 Annex G as well as according to the SIP/SDP (SIPS/TLS) key management. The TLS is also used for HTTP, it requires an X.509 public key/certificate.infrastructure in place.

As the security of data transfer used for configuration is considered crucial, HTTPS is a mandatory requirement. This implies the existence of an X.509 certificate on each device. innovaphone devices entertain various http-based client connections to foreign http servers (e.g. for voice announcements, configuration provisioning). Since these connections are (at least) as critical as configuration sessions where the device acts as an http server, both proper http digest authentication and also TLS content encryption (https) is implemented by innovaphone.

The use of telnet to access innovaphone devices is deprecated and thus there is no need to address possible security issues related to the telnet access. As a “best practice” rule it is recommended to disable telnet access anyway (which in fact is the default configuration anyway).

While innovaphone devices do support SNMP, they do not allow any modification or retrieval of sensitive data using this mechanism. It is merely meant to facilitate maintaining devices health status. SNMP should be guarded against risk originating externally anyway (e.g. using firewall techniques). Risks originating from inside the organisation are considered less important. innovaphone will thus stay with the current SNMP v1 implementation.

innovaphone systems make extensive use of LDAP queries to synchronize distributed PBX systems. These communications obviously carry sensitive data (although from the very beginning there were no passwords conveyed in clear). innovaphone has implemented TLS for LDAP for inter-PBX communication. Securing LDAP access by clients (i.e. phones) to organisational directory services is considered less important as the conveyed data usually is not as critical. Also, existing directory servers may not support TLS for LDAP.

While 802.1X port security adds some extra barrier against certain types of internal risks, it also creates a number of open issues. Telephones usually are considered to work even if they are currently not authenticated by user. This may be mandatory for emergency calls for example. Use of port security would then mandate the storage of a fixed password within the non-volatile memory of an IP phone. Furthermore, the authentication of the second (PC) port needs to be performed with 802.1.x multiple authentications. innovaphone has implemented 802.1x on all of its devices.

As [[Howto:Protection against Brute Force Attacks | brute force attacks]] are very common these days, it is recommended to limit the ip subnets for configuration access (HTTP access filter). Configure that only registrations with password are allowed. For each object set a complex password or configure them with the [[Reference9:PBX/Objects#Devices |admin password check-mark]]. Set the device field empty at the object when no registration should take place, thus nobody can register at all at this object. Deactivate "unknown registrations" or set them with admin password check-mark. From version 11r1 on, it is recommended to use [[Reference11r1:Concept_H.323_over_TCP/TLS_(H.460.17) | H.323/TLS certificate based registration ]] whenever possible.

===Related Articles===
* [[Reference13r3:Concept_myApps#Brute_force_protection]]
* [[Howto:Protection against Brute Force Attacks]]
* [[Howto:How to physically erase flash memory content]]
* [[Howto:SIPS will work with V7]]
* [[Howto:Certificate_management]]
* [[Reference9:PBX/Config/Security]]
* [[Support:Protection against "Cross-Site-Request-Forgery"]]
* [[Reference12r1:Concept_Reverse_Proxy]]

[[Category:Howto|{{PAGENAME}}]]

Template:TLS profiles

2026-08-10T13:10:24Z

Vsc: Created page with "** legacy - all TLS versions and ciphers for compatibility with legacy endpoints ** normal (default setting) - TLS 1.2 and 1.3 ** strict - TLS 1.3"

** legacy - all TLS versions and ciphers for compatibility with legacy endpoints
** normal (default setting) - TLS 1.2 and 1.3
** strict - TLS 1.3

Reference15r1:PBX/Config/General

2026-08-10T05:49:01Z

Vsc: Undo revision 80336 by Tsbodry (talk)

== Configuration ==

=== Common ===

;PBX Mode: The PBX operating mode
:* '''Off''' - The PBX is disabled. After enabling the PBX a browser refresh is needed to activate additional PBX webpages.
:* '''Master''' - The PBX on this device acts as Master. Within a multisite installation exactly one PBX must be configured as Master.
:* '''Slave''' - The PBX on this device acts as Slave. Within a multisite installation several PBXes can be configured as Slave.
:* '''Standby''' - The PBX on this device acts as Standby for the Master. As long as the master is available, this PBX is not active, but just monitors the Master. If the Master is not available this PBX is active.
:* '''Standby-Slave''' - The PBX on this device acts as Standby for a Slave. As long as the slave is available, this PBX is not active, but just monitors the slave. If the slave is not available this PBX is active.

;System Name: The system Name. On all PBX within a multisite installation the same System Name must be configured. For H.323 endpoints this name is the gatekeeper identifier, for SIP endpoints it is the server name.

;Use as Domain: Uses the ''System Name'' as domain name, together with the name field in the user object the PBX constructs the email address (used for sending emails out ox myPBX). This mechanism is also used for Federation, to federate with other domains.

;PBX Name: The name of the PBX on this device. With this name a PBX is associated to a node. The field 'Name' (not Long Name) of a PBX Node object relates to this name.

;DNS: DNS Name of the PBX. If configured this will be used for myPBX redirects if a client tries to register at a PBX on which the user is not configured.

;Unknown Registrations: If this checkmark is set, the PBX accepts 'unknown' registrations. This means registrations with no matching object configured. If from an endpoint registered in this way a number of an object is dialed, which has no registration active and no 'HW-ID' configured the name used for the registration is configured as 'HW-ID' of this object. This is an easy way to deploy large numbers of phones.

:'''With PBX Pwd only:''' If checked only registrations with a PBX authentication or a verified certificate in case of H.323/TLS are accepted. In this case either "PBX Pwd" or "TLS only" is set in a device generated.

;Reverse Proxy Addresses: Up to 8 IP-Addresses (Mixed IPv4 and IPv6 allowed, but no DNS names) can be entered in this field, separated by comma. Registrations from one of these addresses are assumed to be routed through a Reverse Proxy. To the address '/<certificate name>' can be added to also check the TLS certificate of the Reverse Proxy. If the reverse proxy certificate is to be verified, the certificate or the issuer of the reverse proxy certificate must be trusted in the PBX. (If you use a SAN certificate you have to enter the first SAN-Name)
:Checking only on the certificate is also possible, by omitting the IP-address, eg '/*.domain.de'. Registrations sent with this certificate are considered to be coming over the Reverse Proxy.
:If empty addresses are used, unauthenticated registrations from unknown or internal addresses are not allowed, but any registration must be authenticated, with a password or the certificate from the reverse proxy.
; Assume TLS: If the ''Assume TLS'' checkmark is set, it is assumed, that the reverse Proxy did a successful check of the TLS certificate against the registration name.

;Media relay endpoint/Firewall public IP: For media relay endpoints (e.g. third party SIP phones) the public address of the firewall of the PBX network can be configured. This address is signaled in the SDP to received RTP from the phone. The firewall should have configured a port forwarding to the PBX or the TURN, for the RTP range of the PBX or TURN.

;Media relay endpoint/TURN: If this checkmark is set, the PBX allocates TURN endpoints for calls to or from media relay endpoints, which registerd thru the reverse proxy (e.g. third party SIP phones)

;IP address for App Platform
: The ip address of an App Platform can be configured here, with a DNS name used for it. If myApps uses a host to access the PBX different from the configured DNS name of the PBX, the hostname in any App url, which matches the configured AP DNS, is replaced by the AP IP. This way it is possible to configure a PBX with DNS names and access it with myApps when the DNS is not yet set up. If the checkmark ''Operation without DNS'' is set as well any matching DNS name is replaced also when an App service requests the URL of another App service (Example: Users requesting the URL of Devices for provisioning) and in the URL sent to the App services itself (Example: Devices uses this URL to construct the URL set at devices for the Devices registration).

: Note that this mode is intended to be able to run the PBX using DNS names while the DNS is not yet in place. Once the DNS is up and running, neither the DNS name of the AP nor its IP address should be configured here.

;Music On Hold URL: A URL for the Music On Hold. This file is read by the PBX using HTTP and sent to a held endpoint via RTP. The format of this URL is

:'''<nowiki>http://<addr>/<file>.$coder?coder=g711a,g711u,g722,g723,g729,opus-nb,opus-wb&repeat=true</nowiki>'''. <addr> is the IP address of the http server, no dns name is allowed here. <file> is the filename. $coder will be replaced by the actual coder used.

:Parameters: ''coder=g729,g711a,g711u,g723,opus-nb,opus-wb'' is the list of available coders. Only these coders must be specified for which a corresponding file exists. ''repeat=true'' should be specified in order to loop the file endlessly. ''random=true'' can be used to start the music on hold on a random point (this will work only if the URL is not local though).

:By default the built-in Music-On-Hold is played (Pseudo URL: "MOH?coder=g729,g711a,g723&repeat=true"). You can also play a dial tone (Pseudo URL "TONE") or a ring-back tone (Pseudo URL "TONE?tone=ringback").

:The maximum length of the URL is limited to 500 characters (bytes).

:If you configure a wrong (or invalid) URL then you will have silence as MOH. To prevent this situation when the MoH for some specific context/user(see below) is missing and silence is played instead of any MoH, an additional parameter ''fallback=true'' is available. If the file provided in the URL is missing (HTTP Error 404 Not Found is delivered by the HTTP Server) and the parameter ''fallback'' is provided, the default MoH will be played instead of silence. To use a custom file as fallback MoH, instead of default MoH, any file name can be provided with the ''fallback'' parameter: e.g. ''fallback=other_filename''. The file other_filename.g7xx must be placed in the same folder as a file provided with URL. A special filename ''fallback=ringback'' can be used to generate a ringback tone (equivalent to ''TONE?tone=ringback'') instead to play an alternative file.

:Within the URL %<id> can be used to put in some context information of the call. The information refers to the party which has put the receiving party on hold. For information about the receiving party itself, the id has to be preceded by '.' (e.g. '''.l''').

:'''l''' Long Name
:'''h''' Name (H.323 id)
:'''n''' Number
:'''N''' Node
:'''P''' PBX
:'''d''' Diverting Name
:'''#d''' Diverting Number

: See [[Howto:Dynamic_MOH]] for more details on how to use dynamic music on hold.

;External Music On Hold: To offload the device from playing the Music on hold, the Music On Hold can be played by a separate device. This device can register with a name configured here. To retrieve the Music On Hold a call is sent to this device. For each held endpoint a call is sent.

;Response Timeout: Global timeout (in seconds) after which any action for no response is taken (e.g. Call Forward on No Response). A timeout configured at any object overrides this value.

;Dial Complete Timeout: Global timeout (in seconds) after which any action for incomplete dialed number is taken (e.g. incomplete destination at trunk object).

;No. of Regs w/o Pwd: Number of registration without password authentication which are allowed per user. If 0 is configured no registration without password is possible.
Pls. note that registrations from 127.0.0.1 w/o password will be accepted anyway

;Security block time(s): Time for which a registration to a user is blocked after attempt with wrong password. Default is 20s. With a value of 0 this features is turned off.

;Recall Timeout: A value configured here enables recall after transfer. If a call is transferred and not answered within this time, the call is sent back to the transferring endpoint.

;Chat no Attachments: If checked, no file attachments are allowed in chats for any user

;Retries on busy (14s): Number of retries (Each attempt runs for 14 seconds) of blind transfer to a busy endpoint, before a recall back to the initiator is executed. During an attempt, the PBX waits to see if the target is free, and then delivers the call. The default value are 4-retries if the field is empty. If there is a 0 configured no further (in addition to the initial) will be executed. (This function depends on the ''Recall Timeout'' so the ''Recall Timeout'' must not be empty)

;Max Call Duration (h): Number of hours until a call with media is disconnected automatically. Affects all calls with initialized media channels signalled via PBX.

;Group Default Visibility: Defines additional visibility for active group members. These are added to the visibility rights derived from the [[{{NAMESPACE}}:PBX/Objects/Visibility | Visibility settings]] in user or template definitions. Note that changes made here only take effect after a re-registration.

;Presence with Alert: Enable presentation of presence on phone upon alert. Setting applies for all PBX users.

;Enable External Transfer: Unless this checkbox is set any attempt to transfer an external call back to an external destination will result in disconnection of the call.

;No CLIR on Internal calls: If checked numbers are displayed even if received with presentation restricted. When sending a call presentation restricted can still be set and should be honored by a public network.

;Media Relay:
:;Off: No Media Relay is done in the PBX
:;On: All media traffic is routed through the PBX. With the '''No Media Relay if Addresses are identical or private''' checkmark, this is not done if the two call endpoints registration addresses are either private or equal (i.e. external endpoints behind the same NAT router). To identify an address as private the "Private Networks" configuration from ''IP4/General/Settings'' is used.
:;Auto: Media traffic is routed through the PBX if calls are between private and public registration addresses but not for calls between private and private or public and public registration addresses. To identify an address as private the "Private Networks" configuration from ''IP4/General/Settings'' is used. In v11 this was the behaviour if ''RTP Proxy'' was ''on''.
: Please note that when media relay is in effect for a call, '''video is not working'''. With ICE (available from v12r1), media relay in the PBX should be obsolete except for special applications. Check ''On'' or ''Auto'' only if you need to have this, since it creates CPU load on the PBX.

;Generate CDRs: If this checkbox is set, the PBX generates CDRs for all calls. For details, refer to the [[{{NAMESPACE}}:Concept_Call_Detail_Record_CDR_PBX|CDR description article]].

;Reverse Lookup URL
: A String in the LDAP URL Format according [https://tools.ietf.org/html/rfc2255 RFC2255] which will be used by the PBX to make a lookup for all external numbers.
: Number resolutions will be forwarded to internal applications like generated CDRs, Phone App etc..
: Example: ''ldaps://ap.innovaphone.com/dc=entries?givenname,sn,company?sub?(metaSearchNumber=+%n)?bindname=innovaphone.com\contacts''
:* dn: ''dc=entries''
:* attributes: ''givenname,sn,company''
:* scope: ''sub''
:* filter: ''(metaSearchNumber=+%n)''
:** %n is a placeholder for the given cgpn
:* extension: ''bindname=innovaphone.com\contacts''
:** The username for the authentication.
:'''Variables'''
:* %n - cgpn
:* %u - h323 name of the current object
:'''Password''': Password to authenticate access for the used ldap source. Leave empty if not required.
: Examples for use of different ldap directories are listed in the [[{{NAMESPACE}}:Concept_Number_Resolution_and_LDAP#PBX_Configuration|Concept Article]]

;Logo URL
:The URL to a customized logo image that will be displayed on the phones. Leave empty to keep the standard logo. The image size should be 220x150px or less with 24Bit color deep or less and an RGB range. The file format should be PNG or JPEG.

;Route Root-Node External Calls to: Destination object (Long Name) of Root-Node external calls. This configuration option is available on the Master or Standby PBX only. Any call which cannot be terminated inside the PBX is sent to this destination as long as neither the source nor the destination of the call can be associated with a node with a PBX configured. This object must be assigned to this PBX.
:'''For calls from local PBX only''': If set on a master, calls from a slave are not sent to this destination but sent back to the slave where the call came from. On the slave the call is then sent to a destination configured with 'Route Root-Node External Calls to'.

;Route PBX-Node External Calls to: Destination object (Long Name) of PBX-Node external calls. Any call which cannot be terminated inside the PBX is sent to this destination as long as the source nor the destination of the call can be associated with the node of this PBX. If a call is sent from or to an object defined inside the node of this PBX or in a node hierarchically below the node of this PBX the call is associated to the node of this PBX. This object must be assigned to this PBX, that is, it has to register to this PBX.

;Route Internal Calls to: Destination object (Long Name) to which any call is sent for which a PBX internal destination was found, except for those calls that originated from that object. This can be used to apply special routing on PBX internal calls.

;Escape Dialtone from: The PBX object (Long Name) to which a call is made to get a dialtone if a dialtone is configured for the escape of a node. As above, this object must be assigned to this PBX.

;Prefix for Intl/Ntl/Subscriber/Area-Code/Country-Code: Prefixes to be used to map International, National and Subscriber numbers.
:* '''International Prefix''' (<code>000</code> in Germany).
:* '''National Prefix''' (<code>00</code> in Germany).
:* '''Subscriber''' (in Germany, <code>0</code> is a commonly used trunk line access code).
::The SubscriberID is used for hotkey-actions within myAPPs-launcher. By use of node-objects, adjust the Subscriber Prefix in the respective [[{{NAMESPACE}}:PBX/Objects/Node#Number_Mapping_.28International.2C_National.2C_Subscriber_Prefix.29|node object number mapping]].
::For myPBX-launcher hotkeys, refer to the [[{{NAMESPACE}}:Phone/User/Directories#Dialing_location|dialing location settings]].

:* '''Area-Code''' (in Germany for example, the town Mannheim has area code <code>621</code>).
:* '''Country-Code''' (for Germany, <code>49</code> would be used)

: These settings resemble the same settings found in the [[{{NAMESPACE}}:PBX/Objects/Node | Node]] and [[{{NAMESPACE}}:PBX/Objects/PBX | PBX]] object. However, they apply to the ''root'' node instead (and should be consistent through all PBXs in a multi-PBX system).
'''Max. length internal number'''

In the phone and softphone App: If the number, witch is dialed is 7 digits or longer, the subscriber prefix is added. (A reset of the pbx and the myApps is needet after changes.)
;Adjust LDAP results for e.164: Add a "+" prefix to an PBX-internal LDAP-contact-search result. This is used for 3rd-party- and DECT-phones which are not able to benefit from the Dialing Location settings in case of LDAP-search in an E.164-setup. See also [[{{NAMESPACE}}:Concept_Number_Adjustments_%28Dialing_Location%29#PBX_database_used_as_LDAP_database|concept description]].

;Tones: The tones scheme to be used for PBX generated dialtones. This applies to dialtones generated for node prefixes, ringback on transfer and some more.

=== Slave PBX ===

If the PBX is operated in Slave mode, then the Slave PBX section is displayed

;Registration: The VOIP protocol used for the registration to the master. Possible choices are H.323, H.323/TCP or H.323/TLS.

;Master: The IP address of the PBX master

;License Only: If set, the PBX obtains license from master, but acts as master in all other respects.

;Alternate Master: The IP address of an alternative PBX master (standby, if available)

;Password: The password to be used for registration at the Master as configured in the corresponding PBX Object (The length of the password is limited to 16 characters)

;Master GK-ID: The System Name/Gatekeeper ID of the PBX Master were will register (Optional, usually used for DynPBX).

;Replication: This parameter allows you to select the replication style for the slave PBX: either ''All'' or ''Local'' (only users that need to be known in this PBX). For the replication process the [[Reference9:PBX/Config/Security|PBX Password]] is used which have to be the same password on all PBXes in the system.

;dyn PBX ID: This parameter allows to set replication from a specific DynPBX configured on the Master Device.

;Use local static User DB: A dynPBX has also this checkmark. The database of the main PBX is used, but be careful due to the increased memory usage. The dynPBX will create its own PBX datastructure which allocates memory.

;Route Master calls if no Master to: If the master is not available, master calls are sent to this destination. Destination has to be an object with active registration.

;Max Calls to Master/No Reroute: This parameter can be used to limit the calls to the master. If a call is sent to the master and there are already calls to/from the master equal to or exceeding this value, the call is rejected if '''No Reroute''' is set or is handled as if the master was not available otherwise.

;License Limits: Here we can set limit of licensing for this Slave PBX for Port, Mobility, Operator and Softwarephone.

For complete replication from master to slave, check also password in [[Reference9:PBX/Config/Security#PBX_password]]

=== Standby PBX ===

If the PBX is operated in Standby mode, then the Standby PBX section is displayed

;Master: The IP address of the PBX master

;Replicate from Master: Turns on full replication from the master PBX

;use TLS: Use LDAPS (TLS) instead of LDAP (TCP).

For complete replication from master to slave or standby, check also password in [[Reference9:PBX/Config/Security#PBX_password]]

Reference14r2:MyApps Plugin for Virtual Desktops

2026-08-06T07:28:56Z

Vsc:

[[Category:Concept|Apps]]
== Description ==
A softphone running at a terminal server (Citrix, Windows, ...) has the problem that audio and video streams start and terminate at the server.
Received audio from remote peer at the server must be transmitted to the local client for playback and audio delivered by the audio device must be also transmitted from the local client to the server for transmission to remote peer.
This transmission of the audio stream between server and client adds a delay which makes the communication impossible.
Video suffers from the same limitations.

The myApps Virtual Desktop Plugin enables media data to be transferred to the local client in terminal server environments.
== Applies To ==
* innovaphone PBX from version 14r2
* Client OS: Windows, Linux<ref>VDI Plugin for Linux only connects to Citrix or VMWare Horizon, RDP still not supported</ref>(Ubuntu 22 or 23, RangeeOS<ref>RangeeOS is listed due to a customer testimonial. No tests have been conducted by innovaphone. Tests were done using myapps 14r2sr3, RangeeOS Firmware 12.00 build 203 ff and Citrix Workspace 2311. (Workspace version 2402 & 2405 have a bug with USB redirection and 2408 is not starting reliably)</ref>, IGEL OS<ref>IGEL OS: available at [https://app.igel.com/myAppsPlugin/15.1.455+1 IGEL App Portal]</ref>) or MacOS operating systems
* Hypervisor OS: Citrix, Windows Terminal Server environments and VMWare Horizon<ref>VMWare Horizon OS is listed due to a customer testimonial. No tests have been conducted by innovaphone.</ref> 
<references/>

== Requirements ==
* innovaphone PBX
* innovaphone myApps native Client
* innovaphone myApps Plugin
Minimum required firmware version for all products mentioned is at least 14r2final – we recommend using the latest version.
== Concept ==
The myApps Plugin at the client is in charge of all tasks related to the media streams and the management of the Audio/Video devices. For instance:
* start or stop an audio/video device
* gathering of the ICE candidates
* connect to a remote peer with the ICE protocol
* start a ringing device
* rendering of video

But we now need a way of communicating between the myApps running at the terminal server and the myApps plugin running at the terminal client in order to carry out all these actions.

Main VDI Platforms (Citrix, Windows, VMware) provide a way of communicating between server and client through Virtual Channels:

* [https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/technical-overview/virtual-channels Citrix technical overview]
* [https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX691230 Citrix support article summary]
* [https://learn.microsoft.com/en-us/windows/win32/termserv/using-terminal-services-virtual-channels Microsoft Remote Desktop Services virtual channels]

=== Call signaling ===
The VDI Plugin has no connection to the PBX. Signaling is still done at the terminal server by the myApps client.

=== Audio transmission ===
The plugin connects Audio, ICE and DTLS directly to the other endpoint. Since Audio itself does not use virtual channels, the plugin on the client must be able [[Howto:What_Ports_are_used_for_Signaling_and_Voice_Traffic_in_SIP_and_H.323%3F#ICE_STUN_TURN|to reach the TURN/STUN server via port 3478]].

== Configuration ==
'''Citrix Workspace app must first be installed on all platforms. This is necessary because the myApps plugin must copy a .dll (Windows) / .so (MacOS/Linux) into the Citrix installation directory. '''
For this to work, the Citrix installation directory must be in the %ProgramFiles(x86)% or %ProgramFiles% directory.

=== Windows ===
The myApps Plugin .msi must be installed or deployed at the Thin-Client and does not require any configuration.

=== MacOS ===
Install the myAppsPlugin.dmg or .pkg at the Thin-Client and does not require any configuration.

=== Linux ===
Update your Linux PC first:

'''sudo apt-get update'''

Download latest Citrix Workspace App (Mar 7, 2024) for Debian and x86_64 platform:

'''https://www.citrix.com/downloads/workspace-app/linux/workspace-app-for-linux-latest.html'''

Citrix Workspace app needs '''libwebkit2gtk-4.0-37''' packet and this packet is not available in Ubuntu-24.04 version.

Install it at your Linux PC:

https://docs.citrix.com/en-us/citrix-workspace-app-for-linux/install.html

'''sudo apt install -f ./icaclient_<version>._amd64.deb'''

Install (or update) now the myApps Plugin:

'''sudo apt install -f ./myAppsPlugin.deb'''

Headset Buttons:

*Jabra: Create a file sudo <your-favorite-text-editor> /etc/udev/rules.d/50-udev-java.rules
**Add <code>ATTRS{idVendor}=="0b0e", MODE="0666", GROUP="users"</code> as content. After creating the udev file (as root), reload the udev rules using: <code>sudo udevadm control --reload</code>
*Epos: Create a file sudo <your-favorite-text-editor> /etc/udev/rules.d/50-udev-epos.rules
** Add <code>ATTRS{idVendor}=="1395", MODE="0666", GROUP="users"</code> as content. After creating the udev file (as root), reload the udev rules using: <code>sudo udevadm control --reload</code>
*Plantronics: Create a file sudo <your-favorite-text-editor> /etc/udev/rules.d/50-udev-plantronics.rules
** Add <code>ATTRS{idVendor}=="047f", MODE="0666", GROUP="users"</code> as content. After creating the udev file (as root), reload the udev rules using: <code>sudo udevadm control --reload</code>
* Snom: Create a file sudo <your-favorite-text-editor> /etc/udev/rules.d/50-udev-snom.rules
** Add <code>ATTRS{idVendor}=="251c", MODE="0666", GROUP="users"</code> as content. After creating the udev file (as root), reload the udev rules using: <code>sudo udevadm control --reload</code>
* Yealink: Create a file sudo <your-favorite-text-editor> /etc/udev/rules.d/50-udev-yealink.rules
** Add <code>ATTRS{idVendor}=="6993", MODE="0666", GROUP="users"</code> as content. After creating the udev file (as root), reload the udev rules using: <code>sudo udevadm control --reload</code>

No additional configuration required.

=== Configuration on the Terminalserver ===
The Softphone App at the terminal server does not require any additional configuration.

== How it works ==
User starts the VDI software (Citrix Workspace App or Windows Remotedesktop) needed to connect to a remote server.

This software automatically starts the myApps Plugin. No user action required.

The user starts myApps at the server for the Softphone App. myApps discovers that it is running in terminal server environment and will connect to the plugin which was already started by the VDI software.

The user does not need to have any knowledge about the myApps Plugin.

== Known issues ==
* The audio module in the MyApps Plugin for Linux/IgelOS has no echo cancellation. It is therefore recommended to use a headset, as headsets usually have their own echo cancellers.
* Webcam and remote videos must be rendered over the Softphone App but for the time being a native window is opened at the terminal client (only for the Windows Plugin)
* Connecting to a conference or 3rd party conference does not transmit video as video starts in the Javascript code of the Softphone App and Javascript has no access to the local webcam at the remote server.
**Video is displayed but with delay due to the rendering process.
**Citrix may provide access to the local webcam internally and the webcam may be available but remote peer will probably experience delay of the received video.
* When MyApps is used as a Citrix Published App, notification pop-ups cannot be displayed. This is because Citrix does not recognize the notifications as part of MyApps and therefore does not show them as part of the published app. If the full desktop is used in Citrix, the notifications function correctly.
* Start of AppSharing remains at the terminal server but the transmission of the media now starts at the local client.
* The MyApps Plugin for macOS supports only Citrix Workspace, the "Windows-App" from Microsoft is currently not supported
 We need to implement an exception for appSharing in the future as the transmission must happen at the server.
 For the time being the appSharing is transmitted to the client and forwarded to the remote peer adding some delay due to this tranmission between server and client (only for the Windows Plugin)

==Troubleshooting==
If the problem still exists after trying the OS-specific hints below, open a support ticket and send a trace from the myApps client (remote) with App and Browser option. Please send also all myAppsPlugin-x.txt and myAppsRemote-x.txt trace files from the myApps-plugin on the local PC.

=== Troubleshooting Windows ===
If Citrix is used as a terminal server environment:
#Citrix must be installed '''BEFORE''' the plugin
#Check in "C:/program files/Citrix/ICA Client" folder, there is the .dll myAppscitrixremoteserviesvc.dll
#Check in the registry, that: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Citrix\ICA Client\Engine\Configuration\Advanced\Modules\ICA 3.0 is there. "VirtualDriverEx" must be there with the value: InnovaphoneCitrixPlugin
#In Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Citrix\ICA Client\Engine\Configuration\Advanced\Modules\InnovaphoneCitrixPlugin as Drivename and DrivenameWin32 you should find the .dll as value and as innovaphone path the path of the plugin for the file myAppsplugin

Dump files are in the trace folder c:\users\$user\Appdata\local\innovaphone\myAppsPlugin if client crash at start.

'''Remote desktop (Windows)'''

After installing the plugin, check this registry folder:

Computer\HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default\AddIns\innovaphoneRemoteServicesSvc64

and check as "Name" the path of the .dll <--- c:\program files(x86)\iinnovaphone\myAppsPlugin\myAppsRemoteServiceSvc64.dll

check that the .dll exist in the mentioned direcotry and the plugin.

'''Disable Echo Canceler (Windows PC)'''

Computer\HKEY_CURRENT_USER\Software\innovaphone\myApps einen neuen Eintrag erstellen:

Type: DWORD (REG_DWORD)

Name: disableEchoCanceller

Value: 1 ( or use, Value: 0 to enable the Echo Canceller)

=== Troubleshooting Linux ===

'''Citrix Workspace App must be installed before the myAppsPlugin'''

Innovaphone Plugin is installed under /opt/innovaphone/'''myAppsPlugin''' and in /opt/Citrix/ICAClient/'''myAppsCitrixPlugin.so'''

myAppsCitrixPlugin.so library is called by the Citrix Workspace App and this library opens the myAppsPlugin.

There is a file in the Citrix installation called module.ini (/opt/Citrix/ICAClient/config/module.ini). Inside this file the myApps Citrix Plugin library is included:

- VirtualDriver entry must contain myAppsCitrixPlugin

- a line with '''myAppsCitrixPlugin=On''' must exist and

Following directory '''/var/log/apps/myAppsPlugin/''' must also exist for the log files with write permission for everyone (drwxrwxrwx)

====Audio Quality issues (e.g. choppy audio)====
If you run into audio quality when using myapps on Linux, the following configuration is recommended:

* Use Pipewire as the audio server
* Set the system-wide sample rate (default 44.1 kHz) to 48 kHz, since most USB headsets (e.g. Jabra) operate at 48 kHz.

You need to apply settings on OS level, since the audio backend and sample rate are operating system settings and cannot be controlled by the application.

You can check the Active audio server and sample rate with the following command:

<code>pactl info</code>

Based on your language-settings you will get a different output.
But you want to look for something like "Server Name" and "Default-Sample-Specification".

The expected results are (Language set to English):

Server Name: pulseaudio

Default Sample Specification: s16le 2ch 48000Hz

If you use pipewire you will get something like this:

Server Name: PulseAudio (on PipeWire 1.4.2)

Default Sample Specification: float32le 2ch 48000Hz

=== Troubleshooting MacOS ===

'''Citrix Workspace App must be installed before the myAppsPlugin'''

In /Library/Application Support/Citrix/PlugIns

must exist myAppsCitrixPlugin.plugin -> /Application/myappsPlugin.app/Contents/PlugIns/myapps_citrix_plugin.plugin

under:

/Users/.../Library/Application Support/Citrix Receiver

there is a file called Modules. Inside this file the myApps Plugin is included:

- VirtualDriver entry must contain myAppsCitrixPlugin

- a line with myAppsCitrixPlugin=On must exist

- and another line with [myAppsCitrixPlugin] too

both things are done during the installation. In case something is not working must check that the link to the plugin exists and that the modules file contains these entries.

And under /Users/.../Library/Containers/com.innovaphone.myapps-plugin-14r2/Data/Documents a log file is created: myAppsPlugin.txt

=== Troubleshooting Citrix ===
A Virtual Channel Policy must be added to the Registry at the '''Citrix Server''':

Create '''VCPolicies''' folder under '''HKLM/Software/Policies/Citrix''' if it does not exist.

Create '''VCPolicies''' folder under '''HKLM/Software/WOW6432Node/Policies/Citrix''' if it does not exist.

Create a REG_MULTI_SZ entry with the name '''VirtualChannelWhiteList'''. This entry must contain as value: '''INNOHDX,C:\Program Files (x86)\innovaphone\myApps\myApps.exe'''

=== Troubleshooting RTP Stream ===

You can analyze the RTP stream with the switch "--record-rtp-stream"

* RTP reception after Echo Canceller and JitterBuffer
* Audio from microphone and send to RTP

You have to start the myApps client as follows: myApps.exe --record-rtp-stream

After the call, you can find the audio files in the folder: C:\Users\...\AppData\Local\innovaphone\myApps

Tool to listen to the RTP stream: Audacity

Go to: File / Import / Raw Data and open the Folder with the Rtp stream and select the file.

For RTP-Send and RTP-Recv Data, use the Audio Codec G711 -> A-Law and 8000

For the Wave-in (out) Data Use Signed 16-bit PCM and 8000 Abtastrate

==Hints==
If all users would like to start with a clean, fresh appproxy (eg to be sure that all cached data is re-retrieved), you can add the appproxy directory to the 'Ausschlussliste - Verzeichnisse'/'Exclusion list - directories' for each user:
* Open Citrix Studio
* Open Policies in the left navigation pane (Configuration/Policies)
* Edit or Create an exisiting policy (Upon create you can filter for 'profile' or 'exclusion'). Search for 'Profile Management/Exclusion list – directories' or 'ProfilverwaltungAusschlussliste Verzeichnisse'.
* Select Exclusion list - directories and click Add.
* Add 'AppData\Local\innovaphone\myApps\appproxy'

== Related Articles ==

* https://wiki.innovaphone.com/index.php?title=Reference14r2:Concept_myApps
* https://wiki.innovaphone.com/index.php?title=Reference14r2:Concept_App_SoftphoneApp

Reference14r2:MyApps Plugin for Virtual Desktops

2026-08-06T07:18:46Z

Vsc: /* Requirements */

[[Category:Concept|Apps]]
== Description ==
A softphone running at a terminal server (Citrix, Windows, ...) has the problem that audio and video streams start and terminate at the server.
Received audio from remote peer at the server must be transmitted to the local client for playback and audio delivered by the audio device must be also transmitted from the local client to the server for transmission to remote peer.
This transmission of the audio stream between server and client adds a delay which makes the communication impossible.
Video suffers from the same limitations.

The myApps Virtual Desktop Plugin enables media data to be transferred to the local client in terminal server environments.
== Applies To ==
* innovaphone PBX from version 14r2
* Client OS: Windows, Linux<ref>VDI Plugin for Linux only connects to Citrix or VMWare Horizon, RDP still not supported</ref>(Ubuntu 22 or 23, RangeeOS<ref>RangeeOS is listed due to a customer testimonial. No tests have been conducted by innovaphone. Tests were done using myapps 14r2sr3, RangeeOS Firmware 12.00 build 203 ff and Citrix Workspace 2311. (Workspace version 2402 & 2405 have a bug with USB redirection and 2408 is not starting reliably)</ref>, IGEL OS<ref>IGEL OS: available at [https://app.igel.com/myAppsPlugin/15.1.455+1 IGEL App Portal]</ref>) or MacOS operating systems
* Hypervisor OS: Citrix, Windows Terminal Server environments and VMWare Horizon<ref>VMWare Horizon OS is listed due to a customer testimonial. No tests have been conducted by innovaphone.</ref> 
<references/>

== Requirements ==
* innovaphone PBX
* innovaphone myApps native Client V14r2
* innovaphone myApps Plugin V14r2
* Firmware V14r2 final

== Concept ==
The myApps Plugin at the client is in charge of all tasks related to the media streams and the management of the Audio/Video devices. For instance:
* start or stop an audio/video device
* gathering of the ICE candidates
* connect to a remote peer with the ICE protocol
* start a ringing device
* rendering of video

But we now need a way of communicating between the myApps running at the terminal server and the myApps plugin running at the terminal client in order to carry out all these actions.

Main VDI Platforms (Citrix, Windows, VMware) provide a way of communicating between server and client through Virtual Channels:

* [https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/technical-overview/virtual-channels Citrix technical overview]
* [https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX691230 Citrix support article summary]
* [https://learn.microsoft.com/en-us/windows/win32/termserv/using-terminal-services-virtual-channels Microsoft Remote Desktop Services virtual channels]

=== Call signaling ===
The VDI Plugin has no connection to the PBX. Signaling is still done at the terminal server by the myApps client.

=== Audio transmission ===
The plugin connects Audio, ICE and DTLS directly to the other endpoint. Since Audio itself does not use virtual channels, the plugin on the client must be able [[Howto:What_Ports_are_used_for_Signaling_and_Voice_Traffic_in_SIP_and_H.323%3F#ICE_STUN_TURN|to reach the TURN/STUN server via port 3478]].

== Configuration ==
'''Citrix Workspace app must first be installed on all platforms. This is necessary because the myApps plugin must copy a .dll (Windows) / .so (MacOS/Linux) into the Citrix installation directory. '''
For this to work, the Citrix installation directory must be in the %ProgramFiles(x86)% or %ProgramFiles% directory.

=== Windows ===
The myApps Plugin .msi must be installed or deployed at the Thin-Client and does not require any configuration.

=== MacOS ===
Install the myAppsPlugin.dmg or .pkg at the Thin-Client and does not require any configuration.

=== Linux ===
Update your Linux PC first:

'''sudo apt-get update'''

Download latest Citrix Workspace App (Mar 7, 2024) for Debian and x86_64 platform:

'''https://www.citrix.com/downloads/workspace-app/linux/workspace-app-for-linux-latest.html'''

Citrix Workspace app needs '''libwebkit2gtk-4.0-37''' packet and this packet is not available in Ubuntu-24.04 version.

Install it at your Linux PC:

https://docs.citrix.com/en-us/citrix-workspace-app-for-linux/install.html

'''sudo apt install -f ./icaclient_<version>._amd64.deb'''

Install (or update) now the myApps Plugin:

'''sudo apt install -f ./myAppsPlugin.deb'''

Headset Buttons:

*Jabra: Create a file sudo <your-favorite-text-editor> /etc/udev/rules.d/50-udev-java.rules
**Add <code>ATTRS{idVendor}=="0b0e", MODE="0666", GROUP="users"</code> as content. After creating the udev file (as root), reload the udev rules using: <code>sudo udevadm control --reload</code>
*Epos: Create a file sudo <your-favorite-text-editor> /etc/udev/rules.d/50-udev-epos.rules
** Add <code>ATTRS{idVendor}=="1395", MODE="0666", GROUP="users"</code> as content. After creating the udev file (as root), reload the udev rules using: <code>sudo udevadm control --reload</code>
*Plantronics: Create a file sudo <your-favorite-text-editor> /etc/udev/rules.d/50-udev-plantronics.rules
** Add <code>ATTRS{idVendor}=="047f", MODE="0666", GROUP="users"</code> as content. After creating the udev file (as root), reload the udev rules using: <code>sudo udevadm control --reload</code>
* Snom: Create a file sudo <your-favorite-text-editor> /etc/udev/rules.d/50-udev-snom.rules
** Add <code>ATTRS{idVendor}=="251c", MODE="0666", GROUP="users"</code> as content. After creating the udev file (as root), reload the udev rules using: <code>sudo udevadm control --reload</code>
* Yealink: Create a file sudo <your-favorite-text-editor> /etc/udev/rules.d/50-udev-yealink.rules
** Add <code>ATTRS{idVendor}=="6993", MODE="0666", GROUP="users"</code> as content. After creating the udev file (as root), reload the udev rules using: <code>sudo udevadm control --reload</code>

No additional configuration required.

=== Configuration on the Terminalserver ===
The Softphone App at the terminal server does not require any additional configuration.

== How it works ==
User starts the VDI software (Citrix Workspace App or Windows Remotedesktop) needed to connect to a remote server.

This software automatically starts the myApps Plugin. No user action required.

The user starts myApps at the server for the Softphone App. myApps discovers that it is running in terminal server environment and will connect to the plugin which was already started by the VDI software.

The user does not need to have any knowledge about the myApps Plugin.

== Known issues ==
* The audio module in the MyApps Plugin for Linux/IgelOS has no echo cancellation. It is therefore recommended to use a headset, as headsets usually have their own echo cancellers.
* Webcam and remote videos must be rendered over the Softphone App but for the time being a native window is opened at the terminal client (only for the Windows Plugin)
* Connecting to a conference or 3rd party conference does not transmit video as video starts in the Javascript code of the Softphone App and Javascript has no access to the local webcam at the remote server.
**Video is displayed but with delay due to the rendering process.
**Citrix may provide access to the local webcam internally and the webcam may be available but remote peer will probably experience delay of the received video.
* When MyApps is used as a Citrix Published App, notification pop-ups cannot be displayed. This is because Citrix does not recognize the notifications as part of MyApps and therefore does not show them as part of the published app. If the full desktop is used in Citrix, the notifications function correctly.
* Start of AppSharing remains at the terminal server but the transmission of the media now starts at the local client.
* The MyApps Plugin for macOS supports only Citrix Workspace, the "Windows-App" from Microsoft is currently not supported
 We need to implement an exception for appSharing in the future as the transmission must happen at the server.
 For the time being the appSharing is transmitted to the client and forwarded to the remote peer adding some delay due to this tranmission between server and client (only for the Windows Plugin)

==Troubleshooting==
If the problem still exists after trying the OS-specific hints below, open a support ticket and send a trace from the myApps client (remote) with App and Browser option. Please send also all myAppsPlugin-x.txt and myAppsRemote-x.txt trace files from the myApps-plugin on the local PC.

=== Troubleshooting Windows ===
If Citrix is used as a terminal server environment:
#Citrix must be installed '''BEFORE''' the plugin
#Check in "C:/program files/Citrix/ICA Client" folder, there is the .dll myAppscitrixremoteserviesvc.dll
#Check in the registry, that: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Citrix\ICA Client\Engine\Configuration\Advanced\Modules\ICA 3.0 is there. "VirtualDriverEx" must be there with the value: InnovaphoneCitrixPlugin
#In Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Citrix\ICA Client\Engine\Configuration\Advanced\Modules\InnovaphoneCitrixPlugin as Drivename and DrivenameWin32 you should find the .dll as value and as innovaphone path the path of the plugin for the file myAppsplugin

Dump files are in the trace folder c:\users\$user\Appdata\local\innovaphone\myAppsPlugin if client crash at start.

'''Remote desktop (Windows)'''

After installing the plugin, check this registry folder:

Computer\HKEY_CURRENT_USER\Software\Microsoft\Terminal Server Client\Default\AddIns\innovaphoneRemoteServicesSvc64

and check as "Name" the path of the .dll <--- c:\program files(x86)\iinnovaphone\myAppsPlugin\myAppsRemoteServiceSvc64.dll

check that the .dll exist in the mentioned direcotry and the plugin.

'''Disable Echo Canceler (Windows PC)'''

Computer\HKEY_CURRENT_USER\Software\innovaphone\myApps einen neuen Eintrag erstellen:

Type: DWORD (REG_DWORD)

Name: disableEchoCanceller

Value: 1 ( or use, Value: 0 to enable the Echo Canceller)

=== Troubleshooting Linux ===

'''Citrix Workspace App must be installed before the myAppsPlugin'''

Innovaphone Plugin is installed under /opt/innovaphone/'''myAppsPlugin''' and in /opt/Citrix/ICAClient/'''myAppsCitrixPlugin.so'''

myAppsCitrixPlugin.so library is called by the Citrix Workspace App and this library opens the myAppsPlugin.

There is a file in the Citrix installation called module.ini (/opt/Citrix/ICAClient/config/module.ini). Inside this file the myApps Citrix Plugin library is included:

- VirtualDriver entry must contain myAppsCitrixPlugin

- a line with '''myAppsCitrixPlugin=On''' must exist and

Following directory '''/var/log/apps/myAppsPlugin/''' must also exist for the log files with write permission for everyone (drwxrwxrwx)

====Audio Quality issues (e.g. choppy audio)====
If you run into audio quality when using myapps on Linux, the following configuration is recommended:

* Use Pipewire as the audio server
* Set the system-wide sample rate (default 44.1 kHz) to 48 kHz, since most USB headsets (e.g. Jabra) operate at 48 kHz.

You need to apply settings on OS level, since the audio backend and sample rate are operating system settings and cannot be controlled by the application.

You can check the Active audio server and sample rate with the following command:

<code>pactl info</code>

Based on your language-settings you will get a different output.
But you want to look for something like "Server Name" and "Default-Sample-Specification".

The expected results are (Language set to English):

Server Name: pulseaudio

Default Sample Specification: s16le 2ch 48000Hz

If you use pipewire you will get something like this:

Server Name: PulseAudio (on PipeWire 1.4.2)

Default Sample Specification: float32le 2ch 48000Hz

=== Troubleshooting MacOS ===

'''Citrix Workspace App must be installed before the myAppsPlugin'''

In /Library/Application Support/Citrix/PlugIns

must exist myAppsCitrixPlugin.plugin -> /Application/myappsPlugin.app/Contents/PlugIns/myapps_citrix_plugin.plugin

under:

/Users/.../Library/Application Support/Citrix Receiver

there is a file called Modules. Inside this file the myApps Plugin is included:

- VirtualDriver entry must contain myAppsCitrixPlugin

- a line with myAppsCitrixPlugin=On must exist

- and another line with [myAppsCitrixPlugin] too

both things are done during the installation. In case something is not working must check that the link to the plugin exists and that the modules file contains these entries.

And under /Users/.../Library/Containers/com.innovaphone.myapps-plugin-14r2/Data/Documents a log file is created: myAppsPlugin.txt

=== Troubleshooting Citrix ===
A Virtual Channel Policy must be added to the Registry at the '''Citrix Server''':

Create '''VCPolicies''' folder under '''HKLM/Software/Policies/Citrix''' if it does not exist.

Create '''VCPolicies''' folder under '''HKLM/Software/WOW6432Node/Policies/Citrix''' if it does not exist.

Create a REG_MULTI_SZ entry with the name '''VirtualChannelWhiteList'''. This entry must contain as value: '''INNOHDX,C:\Program Files (x86)\innovaphone\myApps\myApps.exe'''

=== Troubleshooting RTP Stream ===

You can analyze the RTP stream with the switch "--record-rtp-stream"

* RTP reception after Echo Canceller and JitterBuffer
* Audio from microphone and send to RTP

You have to start the myApps client as follows: myApps.exe --record-rtp-stream

After the call, you can find the audio files in the folder: C:\Users\...\AppData\Local\innovaphone\myApps

Tool to listen to the RTP stream: Audacity

Go to: File / Import / Raw Data and open the Folder with the Rtp stream and select the file.

For RTP-Send and RTP-Recv Data, use the Audio Codec G711 -> A-Law and 8000

For the Wave-in (out) Data Use Signed 16-bit PCM and 8000 Abtastrate

==Hints==
If all users would like to start with a clean, fresh appproxy (eg to be sure that all cached data is re-retrieved), you can add the appproxy directory to the 'Ausschlussliste - Verzeichnisse'/'Exclusion list - directories' for each user:
* Open Citrix Studio
* Open Policies in the left navigation pane (Configuration/Policies)
* Edit or Create an exisiting policy (Upon create you can filter for 'profile' or 'exclusion'). Search for 'Profile Management/Exclusion list – directories' or 'ProfilverwaltungAusschlussliste Verzeichnisse'.
* Select Exclusion list - directories and click Add.
* Add 'AppData\Local\innovaphone\myApps\appproxy'

== Related Articles ==

* https://wiki.innovaphone.com/index.php?title=Reference14r2:Concept_myApps
* https://wiki.innovaphone.com/index.php?title=Reference14r2:Concept_App_SoftphoneApp

Howto:Ilink-crm-ext- ilink - Partner App

2026-08-05T12:44:53Z

Vsc: /* Licensing */

[[Image:ilink.jpg|200px|right|/Ilink.jpg|ilink.jpg/]]

==Product Name==


ilink Kommunikationssysteme GmbH [https://www.ilink.de/ilink-crmext/info.html ilink CRM Extensions]

==Certification Status==

{{Template:Compat_Status_referral_product_new|type=App}}

This App has been listed March 2023.

==Category==

[[Category:Partner Apps|{{PAGENAME}}]]
{{Category:3rdParty App Development}}
[[Category:3rdParty App Development|{{PAGENAME}}]]

==Vendor==



[[Image:ilink.jpg|150px|/Ilink.jpg|ilink.jpg/]]





[https://www.ilink.de/ ilink - About us]

==Description==






ilink CRM Extensions is a slim and flexible Windows application for inbound caller recognition and for dialing phone numbers through company phones with a click. And it works in home offices, too!

A popup window displays information like caller name, company, location, and phone number for inbound calls. This information is directly taken from your CRM system, from your address book, or from public telephone directories. Using the „Open Contact“ button, the user directly opens the corresponding contact view of his CRM client. Dial with single click from many CRM systems, or use the hotkey to dial from almost all Windows applications.

Supported CRM systems include:Act!, Datev, Goldmine Premium Edition, HCL Connections, HCL Notes, HubSpot, Maximizer CRM, Microsoft Dynamics CRM, Microsoft Outlook + Exchange Public Folder, Netsuite, ODBC databases - customizing through SQL commands, Sage CRM, Salesforce.com, SAP, Sugar CRM, Tigerpaw CRM, vCard / LDAP.

Supported online telephone books: telefonbuch.de (Germany), Das Örtliche (Germany), local.ch (Switzerland), search.ch (Switzerland), herold.at (Austria), whitepages.com (USA).


[https://www.ilink.de/de/products/ilink_crm_extensions/innovaphone/index.html - About this application]

==Licensing==



[https://www.innovaphone.com/en/services/licenses/partner-app-licenses.html?app=ilink%20crm%20extensions See ilink crm-ext license conditions]

==Versions==


===Compatible innovaphone firmware versions===

* innovaphone V13r2 or higher
===Application versions used for interop testing===


* ilink ilink-crm-ext 1008 final, 27/03/2023

* innovaphone V13r2, 15r1sr3

==Configuration==










[https://www.ilink.de/de/products/ilink_crm_extensions/innovaphone/install-configuration.html See ilink configuration (German) guide for innovaphone myApps] 
[https://www.ilink.de/en/products/ilink_crm_extensions/innovaphone/install-configuration.html See ilink configuration (English) guide for innovaphone myApps]

Please note: The name of the PBX object must be spelled exactly: ilink-crmext
Using another name leads to an error message "ilink-crmext" in the log files.

==Contact==




{|
| ilink Kommunikationssysteme GmbH
|-
| Tel: +49 30 28526 1254
|-
|Mob: +49 171 6407377
|-
| Mail: [mailto:info@ilink.de info@ilink.de]
|}
Open Q&A and product demo and discussions: Every Wednesday at 10:00 here: https://sametime.dnug.de/meeting/CRMIntegrationen

For any questions please refer to [https://www.ilink.de/en/products/ilink_crm_extensions/innovaphone/support.html our contact page].

Howto:Ilink-crm-ext- ilink - Partner App

2026-08-05T11:27:52Z

Vsc: /* Licensing */

[[Image:ilink.jpg|200px|right|/Ilink.jpg|ilink.jpg/]]

==Product Name==


ilink Kommunikationssysteme GmbH [https://www.ilink.de/ilink-crmext/info.html ilink CRM Extensions]

==Certification Status==

{{Template:Compat_Status_referral_product_new|type=App}}

This App has been listed March 2023.

==Category==

[[Category:Partner Apps|{{PAGENAME}}]]
{{Category:3rdParty App Development}}
[[Category:3rdParty App Development|{{PAGENAME}}]]

==Vendor==



[[Image:ilink.jpg|150px|/Ilink.jpg|ilink.jpg/]]





[https://www.ilink.de/ ilink - About us]

==Description==






ilink CRM Extensions is a slim and flexible Windows application for inbound caller recognition and for dialing phone numbers through company phones with a click. And it works in home offices, too!

A popup window displays information like caller name, company, location, and phone number for inbound calls. This information is directly taken from your CRM system, from your address book, or from public telephone directories. Using the „Open Contact“ button, the user directly opens the corresponding contact view of his CRM client. Dial with single click from many CRM systems, or use the hotkey to dial from almost all Windows applications.

Supported CRM systems include:Act!, Datev, Goldmine Premium Edition, HCL Connections, HCL Notes, HubSpot, Maximizer CRM, Microsoft Dynamics CRM, Microsoft Outlook + Exchange Public Folder, Netsuite, ODBC databases - customizing through SQL commands, Sage CRM, Salesforce.com, SAP, Sugar CRM, Tigerpaw CRM, vCard / LDAP.

Supported online telephone books: telefonbuch.de (Germany), Das Örtliche (Germany), local.ch (Switzerland), search.ch (Switzerland), herold.at (Austria), whitepages.com (USA).


[https://www.ilink.de/de/products/ilink_crm_extensions/innovaphone/index.html - About this application]

==Licensing==



[https://www.innovaphone.com/de/services/lizenzen/partner-app-lizenzen.html?app=ilink%20crm%20extensions See ilink crm-ext license conditions]

==Versions==


===Compatible innovaphone firmware versions===

* innovaphone V13r2 or higher
===Application versions used for interop testing===


* ilink ilink-crm-ext 1008 final, 27/03/2023

* innovaphone V13r2, 15r1sr3

==Configuration==










[https://www.ilink.de/de/products/ilink_crm_extensions/innovaphone/install-configuration.html See ilink configuration (German) guide for innovaphone myApps] 
[https://www.ilink.de/en/products/ilink_crm_extensions/innovaphone/install-configuration.html See ilink configuration (English) guide for innovaphone myApps]

Please note: The name of the PBX object must be spelled exactly: ilink-crmext
Using another name leads to an error message "ilink-crmext" in the log files.

==Contact==




{|
| ilink Kommunikationssysteme GmbH
|-
| Tel: +49 30 28526 1254
|-
|Mob: +49 171 6407377
|-
| Mail: [mailto:info@ilink.de info@ilink.de]
|}
Open Q&A and product demo and discussions: Every Wednesday at 10:00 here: https://sametime.dnug.de/meeting/CRMIntegrationen

For any questions please refer to [https://www.ilink.de/en/products/ilink_crm_extensions/innovaphone/support.html our contact page].

Howto:Ilink-crm-ext- ilink - Partner App

2026-08-05T11:25:53Z

Vsc:

[[Image:ilink.jpg|200px|right|/Ilink.jpg|ilink.jpg/]]

==Product Name==


ilink Kommunikationssysteme GmbH [https://www.ilink.de/ilink-crmext/info.html ilink CRM Extensions]

==Certification Status==

{{Template:Compat_Status_referral_product_new|type=App}}

This App has been listed March 2023.

==Category==

[[Category:Partner Apps|{{PAGENAME}}]]
{{Category:3rdParty App Development}}
[[Category:3rdParty App Development|{{PAGENAME}}]]

==Vendor==



[[Image:ilink.jpg|150px|/Ilink.jpg|ilink.jpg/]]





[https://www.ilink.de/ ilink - About us]

==Description==






ilink CRM Extensions is a slim and flexible Windows application for inbound caller recognition and for dialing phone numbers through company phones with a click. And it works in home offices, too!

A popup window displays information like caller name, company, location, and phone number for inbound calls. This information is directly taken from your CRM system, from your address book, or from public telephone directories. Using the „Open Contact“ button, the user directly opens the corresponding contact view of his CRM client. Dial with single click from many CRM systems, or use the hotkey to dial from almost all Windows applications.

Supported CRM systems include:Act!, Datev, Goldmine Premium Edition, HCL Connections, HCL Notes, HubSpot, Maximizer CRM, Microsoft Dynamics CRM, Microsoft Outlook + Exchange Public Folder, Netsuite, ODBC databases - customizing through SQL commands, Sage CRM, Salesforce.com, SAP, Sugar CRM, Tigerpaw CRM, vCard / LDAP.

Supported online telephone books: telefonbuch.de (Germany), Das Örtliche (Germany), local.ch (Switzerland), search.ch (Switzerland), herold.at (Austria), whitepages.com (USA).


[https://www.ilink.de/de/products/ilink_crm_extensions/innovaphone/index.html - About this application]

==Licensing==



[https://www.ilink.de/de/products/ilink_crm_extensions/innovaphone/license.html See ilink crm-ext license conditions]

==Versions==


===Compatible innovaphone firmware versions===

* innovaphone V13r2 or higher
===Application versions used for interop testing===


* ilink ilink-crm-ext 1008 final, 27/03/2023

* innovaphone V13r2, 15r1sr3

==Configuration==










[https://www.ilink.de/de/products/ilink_crm_extensions/innovaphone/install-configuration.html See ilink configuration (German) guide for innovaphone myApps] 
[https://www.ilink.de/en/products/ilink_crm_extensions/innovaphone/install-configuration.html See ilink configuration (English) guide for innovaphone myApps]

Please note: The name of the PBX object must be spelled exactly: ilink-crmext
Using another name leads to an error message "ilink-crmext" in the log files.

==Contact==




{|
| ilink Kommunikationssysteme GmbH
|-
| Tel: +49 30 28526 1254
|-
|Mob: +49 171 6407377
|-
| Mail: [mailto:info@ilink.de info@ilink.de]
|}
Open Q&A and product demo and discussions: Every Wednesday at 10:00 here: https://sametime.dnug.de/meeting/CRMIntegrationen

For any questions please refer to [https://www.ilink.de/en/products/ilink_crm_extensions/innovaphone/support.html our contact page].

Howto:ECOMS-KI - DATUS AG - 3rd Party Product

2026-08-04T07:17:11Z

Vsc: /* Description */

[[Image:Datus_Company_Logo.png||200px|right]]

==Product Name==


DATUS AG [https://www.datus.com/kopie-von-ecoms-l%C3%B6sungen-f%C3%BCr-notruf ECOMS-KI]

==Certification Status==

{{Template:Compat_Status_referral_product_new}}
Testing of this product has been finalized July, 2026.

==Category==

{{Category:3rdParty Contact Center Applications}}
[[Category:Referral Product|{{PAGENAME}}]]
[[Category:3rdParty Contact Center Applications|{{PAGENAME}}]]

==Vendor==



[[Image:Datus_Company_Logo.png|150px|link=https://www.datus.com/]]

DATUS AG has been a specialist in customized IT solutions for more than 50 years and offers a broad portfolio of in-house developed products.

Our focus is on designing innovative, tailor-made communication solutions.

As a medium-sized company, we successfully deliver projects of all sizes using state-of-the-art technology – Made in Germany.

==Description==



[[Image:Datus_EcomsKI_Logo.png|link=https://www.datus.com/kopie-von-ecoms-l%C3%B6sungen-f%C3%BCr-notruf]]

ECOMS-KI is a modular platform that provides a flexible solution for integrating artificial intelligence into the innovaphone PBX.

Whether for real-time translation, transcription, call summarization, voicebot applications, or the optimization of workflows and business processes, ECOMS-KI enables a wide range of innovative use cases.

==Functions==


The system meets the highest data protection requirements and can be deployed either entirely on-premises or in a cloud environment.

Integration with the innovaphone PBX is established via a SIP trunk connection.

==Use Cases==

===Alternis Translation===
[[Image:Datus_Ecoms_Alternis.png]]

===Voicebot Application – Example Use Case: Medical Transport===
[[Image:Datus_Ecoms_Voicebot.png]]

===Workflow – Example Use Case: Standardized Emergency Call Interrogation===
[[Image:Datus_Ecoms_Workflow.png]]

==Version==



Product versions used for interop testing:


'''innovaphone PBX:'''
 innovaphone Virtual Appliance based on Proxmox 16r1sr2 [16.1.0910]

'''ECOMS-KI:'''
 Indali PBX: Release R11.0.7 (B48)

==Configuration==






===Overview===
[[Image:Datus_Ecoms_innovaphone.png]]

===Configuration of the innovaphone PBX===
====PBX Config====
[[Image:Datus_Ecoms_innovaphone_pbx_1.png]]
====PBX Objects====
[[Image:Datus_Ecoms_innovaphone_pbx_2.png]]
====SIP Interface====
[[Image:Datus_Ecoms_innovaphone_pbx_3.png]]

Alternatively, TCP can be selected as the transport protocol. In this case, both indali PBX VoIP accounts must also be configured to use TCP as the transport protocol. TLS is currently not supported.
====Gateway SIP CGPN and CDPN Modification====
[[Image:Datus_Ecoms_innovaphone_pbx_4.png]]
====Gateway Gatekeeper====
[[Image:Datus_Ecoms_innovaphone_pbx_7.png]]
====Gateway Routes====
[[Image:Datus_Ecoms_innovaphone_pbx_8.png]]

===Configuration of ECOMS-KI / indali PBX===
====Telephone System -> VoIP Accounts====
[[Image:Datus_Ecoms_indali_4.png]]
====VoIP Account -> From Innovaphone PBX====
[[Image:Datus_Ecoms_indali_5.png]]
====VoIP Account -> To Innovaphone PBX====
[[Image:Datus_Ecoms_indali_6.png]]
====Call Rules -> Incoming Calls====
[[Image:Datus_Ecoms_indali_7.png]] 
[[Image:Datus_Ecoms_indali_8.png]] 
[[Image:Datus_Ecoms_indali_9.png]]

==Summary==


The configuration described in this document establishes the connection between the innovaphone PBX and the indali PBX and provides the basis for integrating the ECOMS-KI ALTERNIS application into the audio stream of active telephone calls.

==Contact==



{|
| DATUS AG
|-
| Service & Support
|-
| Pascalstr. 12
|-
| 52076 Aachen Germany
|-
| Tel: [tel:00492408938243 +49 2408 9382-43]
|-
| Fax: +49 2408 9382-943
|-
| Mail: [mailto:dsc.hotline@datus.com dsc.hotline@datus.com]
|}

Howto:ECOMS-KI - DATUS AG - 3rd Party Product

2026-08-04T07:16:49Z

Vsc: /* Description */

[[Image:Datus_Company_Logo.png||200px|right]]

==Product Name==


DATUS AG [https://www.datus.com/kopie-von-ecoms-l%C3%B6sungen-f%C3%BCr-notruf ECOMS-KI]

==Certification Status==

{{Template:Compat_Status_referral_product_new}}
Testing of this product has been finalized July, 2026.

==Category==

{{Category:3rdParty Contact Center Applications}}
[[Category:Referral Product|{{PAGENAME}}]]
[[Category:3rdParty Contact Center Applications|{{PAGENAME}}]]

==Vendor==



[[Image:Datus_Company_Logo.png|150px|link=https://www.datus.com/]]

DATUS AG has been a specialist in customized IT solutions for more than 50 years and offers a broad portfolio of in-house developed products.

Our focus is on designing innovative, tailor-made communication solutions.

As a medium-sized company, we successfully deliver projects of all sizes using state-of-the-art technology – Made in Germany.

==Description==



[[Image:Datus_EcomsKI_Logo.png<link=https://www.datus.com/kopie-von-ecoms-l%C3%B6sungen-f%C3%BCr-notruf]]

ECOMS-KI is a modular platform that provides a flexible solution for integrating artificial intelligence into the innovaphone PBX.

Whether for real-time translation, transcription, call summarization, voicebot applications, or the optimization of workflows and business processes, ECOMS-KI enables a wide range of innovative use cases.

==Functions==


The system meets the highest data protection requirements and can be deployed either entirely on-premises or in a cloud environment.

Integration with the innovaphone PBX is established via a SIP trunk connection.

==Use Cases==

===Alternis Translation===
[[Image:Datus_Ecoms_Alternis.png]]

===Voicebot Application – Example Use Case: Medical Transport===
[[Image:Datus_Ecoms_Voicebot.png]]

===Workflow – Example Use Case: Standardized Emergency Call Interrogation===
[[Image:Datus_Ecoms_Workflow.png]]

==Version==



Product versions used for interop testing:


'''innovaphone PBX:'''
 innovaphone Virtual Appliance based on Proxmox 16r1sr2 [16.1.0910]

'''ECOMS-KI:'''
 Indali PBX: Release R11.0.7 (B48)

==Configuration==






===Overview===
[[Image:Datus_Ecoms_innovaphone.png]]

===Configuration of the innovaphone PBX===
====PBX Config====
[[Image:Datus_Ecoms_innovaphone_pbx_1.png]]
====PBX Objects====
[[Image:Datus_Ecoms_innovaphone_pbx_2.png]]
====SIP Interface====
[[Image:Datus_Ecoms_innovaphone_pbx_3.png]]

Alternatively, TCP can be selected as the transport protocol. In this case, both indali PBX VoIP accounts must also be configured to use TCP as the transport protocol. TLS is currently not supported.
====Gateway SIP CGPN and CDPN Modification====
[[Image:Datus_Ecoms_innovaphone_pbx_4.png]]
====Gateway Gatekeeper====
[[Image:Datus_Ecoms_innovaphone_pbx_7.png]]
====Gateway Routes====
[[Image:Datus_Ecoms_innovaphone_pbx_8.png]]

===Configuration of ECOMS-KI / indali PBX===
====Telephone System -> VoIP Accounts====
[[Image:Datus_Ecoms_indali_4.png]]
====VoIP Account -> From Innovaphone PBX====
[[Image:Datus_Ecoms_indali_5.png]]
====VoIP Account -> To Innovaphone PBX====
[[Image:Datus_Ecoms_indali_6.png]]
====Call Rules -> Incoming Calls====
[[Image:Datus_Ecoms_indali_7.png]] 
[[Image:Datus_Ecoms_indali_8.png]] 
[[Image:Datus_Ecoms_indali_9.png]]

==Summary==


The configuration described in this document establishes the connection between the innovaphone PBX and the indali PBX and provides the basis for integrating the ECOMS-KI ALTERNIS application into the audio stream of active telephone calls.

==Contact==



{|
| DATUS AG
|-
| Service & Support
|-
| Pascalstr. 12
|-
| 52076 Aachen Germany
|-
| Tel: [tel:00492408938243 +49 2408 9382-43]
|-
| Fax: +49 2408 9382-943
|-
| Mail: [mailto:dsc.hotline@datus.com dsc.hotline@datus.com]
|}

Howto:ECOMS-KI - DATUS AG - 3rd Party Product

2026-08-04T07:16:17Z

Vsc: /* Vendor */

[[Image:Datus_Company_Logo.png||200px|right]]

==Product Name==


DATUS AG [https://www.datus.com/kopie-von-ecoms-l%C3%B6sungen-f%C3%BCr-notruf ECOMS-KI]

==Certification Status==

{{Template:Compat_Status_referral_product_new}}
Testing of this product has been finalized July, 2026.

==Category==

{{Category:3rdParty Contact Center Applications}}
[[Category:Referral Product|{{PAGENAME}}]]
[[Category:3rdParty Contact Center Applications|{{PAGENAME}}]]

==Vendor==



[[Image:Datus_Company_Logo.png|150px|link=https://www.datus.com/]]

DATUS AG has been a specialist in customized IT solutions for more than 50 years and offers a broad portfolio of in-house developed products.

Our focus is on designing innovative, tailor-made communication solutions.

As a medium-sized company, we successfully deliver projects of all sizes using state-of-the-art technology – Made in Germany.

==Description==



[[Image:Datus_EcomsKI_Logo.png]]

ECOMS-KI is a modular platform that provides a flexible solution for integrating artificial intelligence into the innovaphone PBX.

Whether for real-time translation, transcription, call summarization, voicebot applications, or the optimization of workflows and business processes, ECOMS-KI enables a wide range of innovative use cases.

==Functions==


The system meets the highest data protection requirements and can be deployed either entirely on-premises or in a cloud environment.

Integration with the innovaphone PBX is established via a SIP trunk connection.

==Use Cases==

===Alternis Translation===
[[Image:Datus_Ecoms_Alternis.png]]

===Voicebot Application – Example Use Case: Medical Transport===
[[Image:Datus_Ecoms_Voicebot.png]]

===Workflow – Example Use Case: Standardized Emergency Call Interrogation===
[[Image:Datus_Ecoms_Workflow.png]]

==Version==



Product versions used for interop testing:


'''innovaphone PBX:'''
 innovaphone Virtual Appliance based on Proxmox 16r1sr2 [16.1.0910]

'''ECOMS-KI:'''
 Indali PBX: Release R11.0.7 (B48)

==Configuration==






===Overview===
[[Image:Datus_Ecoms_innovaphone.png]]

===Configuration of the innovaphone PBX===
====PBX Config====
[[Image:Datus_Ecoms_innovaphone_pbx_1.png]]
====PBX Objects====
[[Image:Datus_Ecoms_innovaphone_pbx_2.png]]
====SIP Interface====
[[Image:Datus_Ecoms_innovaphone_pbx_3.png]]

Alternatively, TCP can be selected as the transport protocol. In this case, both indali PBX VoIP accounts must also be configured to use TCP as the transport protocol. TLS is currently not supported.
====Gateway SIP CGPN and CDPN Modification====
[[Image:Datus_Ecoms_innovaphone_pbx_4.png]]
====Gateway Gatekeeper====
[[Image:Datus_Ecoms_innovaphone_pbx_7.png]]
====Gateway Routes====
[[Image:Datus_Ecoms_innovaphone_pbx_8.png]]

===Configuration of ECOMS-KI / indali PBX===
====Telephone System -> VoIP Accounts====
[[Image:Datus_Ecoms_indali_4.png]]
====VoIP Account -> From Innovaphone PBX====
[[Image:Datus_Ecoms_indali_5.png]]
====VoIP Account -> To Innovaphone PBX====
[[Image:Datus_Ecoms_indali_6.png]]
====Call Rules -> Incoming Calls====
[[Image:Datus_Ecoms_indali_7.png]] 
[[Image:Datus_Ecoms_indali_8.png]] 
[[Image:Datus_Ecoms_indali_9.png]]

==Summary==


The configuration described in this document establishes the connection between the innovaphone PBX and the indali PBX and provides the basis for integrating the ECOMS-KI ALTERNIS application into the audio stream of active telephone calls.

==Contact==



{|
| DATUS AG
|-
| Service & Support
|-
| Pascalstr. 12
|-
| 52076 Aachen Germany
|-
| Tel: [tel:00492408938243 +49 2408 9382-43]
|-
| Fax: +49 2408 9382-943
|-
| Mail: [mailto:dsc.hotline@datus.com dsc.hotline@datus.com]
|}

Howto:ECOMS-KI - DATUS AG - 3rd Party Product

2026-08-04T06:49:06Z

Vsc: Created page with " right ==Product Name==   DATUS AG [https://www.datus.com/kopie-von-ecoms-l%C3%B6sungen-f%C3%BCr-notruf ECOMS-KI] ==Certification Status== <!-- do not remove comment. Will be done by innovaphone upon document che..."

[[Image:Datus_Company_Logo.png||200px|right]]

==Product Name==


DATUS AG [https://www.datus.com/kopie-von-ecoms-l%C3%B6sungen-f%C3%BCr-notruf ECOMS-KI]

==Certification Status==

{{Template:Compat_Status_referral_product_new}}
Testing of this product has been finalized July, 2026.

==Category==

{{Category:3rdParty Contact Center Applications}}
[[Category:Referral Product|{{PAGENAME}}]]
[[Category:3rdParty Contact Center Applications|{{PAGENAME}}]]

==Vendor==



[[Image:Datus_Company_Logo.png|150px]]

DATUS AG has been a specialist in customized IT solutions for more than 50 years and offers a broad portfolio of in-house developed products.

Our focus is on designing innovative, tailor-made communication solutions.

As a medium-sized company, we successfully deliver projects of all sizes using state-of-the-art technology – Made in Germany.

==Description==



[[Image:Datus_EcomsKI_Logo.png]]

ECOMS-KI is a modular platform that provides a flexible solution for integrating artificial intelligence into the innovaphone PBX.

Whether for real-time translation, transcription, call summarization, voicebot applications, or the optimization of workflows and business processes, ECOMS-KI enables a wide range of innovative use cases.

==Functions==


The system meets the highest data protection requirements and can be deployed either entirely on-premises or in a cloud environment.

Integration with the innovaphone PBX is established via a SIP trunk connection.

==Use Cases==

===Alternis Translation===
[[Image:Datus_Ecoms_Alternis.png]]

===Voicebot Application – Example Use Case: Medical Transport===
[[Image:Datus_Ecoms_Voicebot.png]]

===Workflow – Example Use Case: Standardized Emergency Call Interrogation===
[[Image:Datus_Ecoms_Workflow.png]]

==Version==



Product versions used for interop testing:


'''innovaphone PBX:'''
 innovaphone Virtual Appliance based on Proxmox 16r1sr2 [16.1.0910]

'''ECOMS-KI:'''
 Indali PBX: Release R11.0.7 (B48)

==Configuration==






===Overview===
[[Image:Datus_Ecoms_innovaphone.png]]

===Configuration of the innovaphone PBX===
====PBX Config====
[[Image:Datus_Ecoms_innovaphone_pbx_1.png]]
====PBX Objects====
[[Image:Datus_Ecoms_innovaphone_pbx_2.png]]
====SIP Interface====
[[Image:Datus_Ecoms_innovaphone_pbx_3.png]]

Alternatively, TCP can be selected as the transport protocol. In this case, both indali PBX VoIP accounts must also be configured to use TCP as the transport protocol. TLS is currently not supported.
====Gateway SIP CGPN and CDPN Modification====
[[Image:Datus_Ecoms_innovaphone_pbx_4.png]]
====Gateway Gatekeeper====
[[Image:Datus_Ecoms_innovaphone_pbx_7.png]]
====Gateway Routes====
[[Image:Datus_Ecoms_innovaphone_pbx_8.png]]

===Configuration of ECOMS-KI / indali PBX===
====Telephone System -> VoIP Accounts====
[[Image:Datus_Ecoms_indali_4.png]]
====VoIP Account -> From Innovaphone PBX====
[[Image:Datus_Ecoms_indali_5.png]]
====VoIP Account -> To Innovaphone PBX====
[[Image:Datus_Ecoms_indali_6.png]]
====Call Rules -> Incoming Calls====
[[Image:Datus_Ecoms_indali_7.png]] 
[[Image:Datus_Ecoms_indali_8.png]] 
[[Image:Datus_Ecoms_indali_9.png]]

==Summary==


The configuration described in this document establishes the connection between the innovaphone PBX and the indali PBX and provides the basis for integrating the ECOMS-KI ALTERNIS application into the audio stream of active telephone calls.

==Contact==



{|
| DATUS AG
|-
| Service & Support
|-
| Pascalstr. 12
|-
| 52076 Aachen Germany
|-
| Tel: [tel:00492408938243 +49 2408 9382-43]
|-
| Fax: +49 2408 9382-943
|-
| Mail: [mailto:dsc.hotline@datus.com dsc.hotline@datus.com]
|}

File:Datus Ecoms indali 9.png

2026-08-04T06:45:26Z

Vsc:

File:Datus Ecoms indali 8.png

2026-08-04T06:45:16Z

Vsc:

File:Datus Ecoms indali 7.png

2026-08-04T06:44:58Z

Vsc:

File:Datus Ecoms indali 6.png

2026-08-04T06:44:50Z

Vsc:

File:Datus Ecoms indali 5.png

2026-08-04T06:44:41Z

Vsc:

File:Datus Ecoms indali 4.png

2026-08-04T06:44:33Z

Vsc:

File:Datus Ecoms innovaphone pbx 8.png

2026-08-04T06:44:01Z

Vsc:

File:Datus Ecoms innovaphone pbx 7.png

2026-08-04T06:43:49Z

Vsc:

File:Datus Ecoms innovaphone pbx 4.png

2026-08-04T06:43:38Z

Vsc:

File:Datus Ecoms innovaphone pbx 3.png

2026-08-04T06:42:57Z

Vsc:

File:Datus Ecoms innovaphone pbx 2.png

2026-08-04T06:42:44Z

Vsc:

File:Datus Ecoms innovaphone pbx 1.png

2026-08-04T06:42:34Z

Vsc:

File:Datus Ecoms innovaphone.png

2026-08-04T06:42:12Z

Vsc:

File:Datus Ecoms Workflow.png

2026-08-04T06:41:34Z

Vsc:

File:Datus Ecoms Voicebot.png

2026-08-04T06:41:23Z

Vsc:

File:Datus Ecoms Alternis.png

2026-08-04T06:41:10Z

Vsc:

File:Datus EcomsKI Logo.png

2026-08-04T06:40:45Z

Vsc:

File:Datus Company Logo.png

2026-08-04T06:40:27Z

Vsc:

Reference:IP73 WLAN WiFi Wireless IP-Phone

2026-07-30T12:13:36Z

Vsc: /* Configuration */

This article describes the IP73 WLAN/WiFi wireless IP phone, differences to the deprecated IP62 Wireless IP phone and a list of compatible WLAN infrastructures.

==Applies To==
This information applies to:
*innovaphone IP73 (50-00073-001)

==Requirements==

To perform configuration changes on the IP73 device a desktop programming kit (IP62/IP64/IP65/IP73) (Art.No. 50-00060-021 / Prod.ID DP1-UAAA/1A1) is required. The programming kit enables to connect the IP73 handset to a PC in order the configuration changes can be done using WinPDM software.

==Feature Comparison==
This chapter describes the differences in the feature sets between old and new WiFi handsets.

{|border="2" cellspacing="4" cellpadding="3" rules="all" style="margin:1em 1em 1em 0; border:solid 1px #AAAAAA; border-collapse:collapse;empty-cells:show;"
|+ Handset Features Matrix
! Feature !! IP62 !! IP73 !! Description
|-
| Signaling Protocols || H.323/SIP || SIP only ||
|-
| Codecs || G.711, G.722, G.729 A || Opus Wideband, G.711, G.722, G.729 A/B/AB ||
|-
| Talk Time/ Standby Time || 15 h / 100 h || 10 h / 100 h || with U-APSD
|-
| WiFi Standards || 802.11 a/b/g/n || 802.11 a/b/g/n/ac, 802.11r, 802.11k || MCS 0-7 only, Fast BSS Transition (FT or 802.11r)
|-
| SSL Certificates || customer managed || preinstalled by innovaphone/customer managed ||
|-
| call diversion || ok || only with DTMF ||
|-
| Headset Connector || 2,5 mm || 3,5 mm ||
|}

As of firmware version 4.0.0, the connection of a central telephone book via LDAP is supported. For configuration to be carried out refer to the [[#Central Phonebook Access|corresponding section below]].

==WLAN Infrastructure Compatibility==

===Certified WLAN Platforms===
'''IMPORTANT''': Ask [mailto:presales_AT_innovaphone_D0T_com innovaphone Presales Team] for possible interop configuration recommendations and pitfalls before you order the WiFi equipment and start with the roll-out.

Note that availability and combinations of controllers and access points may be subject to change by the manufacturer and are not in the responsability of innovaphone. Errors and omissions excepted.

Wi-Fi infrastructures not listed in this document are not supported. Use of the IP73 in unsupported infrastructures is at your own risk.

{| class="wikitable"
|+Certified WLAN Platforms as of March 2026
!AP Model
!Controller Model
!SW Version
!Test date
!Report
|-
! colspan="5" |Aruba
|-
|AP 303, 304, 305, 314, 315, 324, 325, 334, 335, 344, 345, 504, 505, 514, 515, 534, 535, 554, 555, 635, 655
|7000/7200/9000/MX-VA-xxx
|8.10.0.13 LSR
|09-Sep-2024
|[[File:P2pdf.png|40px|link={{fullurl:Special:FilePath/i63_interop_aruba_networking_8_10_0_13.pdf}}]]
|-
|AP 303, 304, 305, 314, 315, 324, 325, 334, 335, 344, 345, 504, 505, 514, 515, 534, 535, 554, 555, 635, 655
|Networking Central
|10.4.1.3_90100
|12-Aug-2024
|[[File:P2pdf.png|40px|link={{fullurl:Special:FilePath/i63_interop_aruba_networking_central_10_4_1_3.pdf}}]]
|-
! colspan="5" |Cisco
|-
|AP 1832, 1852, 2802, 3802, 4800, 9105, 9115, 9117, 9120, 9130
|WLC 3504, 5520, 8540, vWLC, Mobility Express Solution
|8.10.162
|04-Feb-2022
|[[File:P2pdf.png|40px|link={{fullurl:Special:FilePath/i63_interop_cisco_wlc_8_10_162.pdf}}]]
|-
|AP 1602, 2602, 3502, 3602, 1702, 2702, 3700, 2802, 3802, 1832, 1852
|WLC 2504, 3504, 5508, 5520, 7510, 8510, 8540, vWLC
|8.5.182
|14-Feb-2022
|[[File:P2pdf.png|40px|link={{fullurl:Special:FilePath/i63_interop_cisco_wlc_8_5_182.pdf}}]]
|-
|AP 1702, 2702, 3702
|Catalyst 9800
|17.3.3
|01-Jun-2021
|[[File:P2pdf.png|40px|link={{fullurl:Special:FilePath/i63_interop_cisco_catalyst_17_3_3.pdf}}]]
|-
|AP 1832, 1852, 2802, 3802, 4800, 9115, 9117, 9120, 9130, 9136
|Catalyst 9800
|17.9.3
|20-Jun-2022
|[[File:P2pdf.png|40px|link={{fullurl:Special:FilePath/i63_interop_cisco_catalyst_17_9_3.pdf}}]]
|-
! colspan="5" |Cisco Meraki
|-
|MR20/MR30H/MR33/MR42/MR42E/MR52/MR53/MR53E/MR70/MR74/MR84 (802.11ac wave 2)
MR36/MR44/MR46/MR46E/MR76/MR86 (802.11ax)
| -
|MR 27.7.1
|29-Sept-2021
|[[File:P2pdf.png|40px|link={{fullurl:Special:FilePath/i63_interop_meraki_mr_27_7_1.pdf}}]]
|-
|MR36/MR44/MR46/MR46E/MR76/MR86 (802.11ax)
CW9162/CW9163E/CW9164/CW9166/CW9166D1 (Wifi 6E)
| -
|MR 30.7
|Nov-2024
|[[File:P2pdf.png|40px|link={{fullurl:Special:FilePath/i63_interop_meraki_mr_30_7.pdf}}]]
|-
! colspan="5" |Extreme Networks (Enterasys/IdentiFi)
|-
|AP 3801, 3805, 3825, 3865, 3935
|Extreme Wireless C25, C35, C2110, C5110, C5210, v2110
|AP:10.51.10
|03-Feb-2020
|[[File:P2pdf.png|40px|link={{fullurl:Special:FilePath/i63_interop_extreme_wireless_10_51_10.pdf}}]]
|-
|AP 122, 130, 230, 250, 550, 650
|Extreme Cloud
|AP 10.0r8, Cloud 20.1.1.3
|19-Mar-2020
|[[File:P2pdf.png|40px|link={{fullurl:Special:FilePath/i63_interop_extreme_cloud_10_0r8.pdf}}]]
|-
|AP 310i/e, 410i/e, 505i/e, 510i/e, 360i/e, 460i/e, 560
|XCC Controllers E1120, E2120, E3120, VE6120/VE6125, VE6120H
|05.16.01.0025
|10-Dec-2020
|[[File:P2pdf.png|40px|link={{fullurl:Special:FilePath/i63_interop_extreme_xcc_05_16_01_0025.pdf}}]]
|-
|AP305c/cx, 410c, 460c, 510c/cx, 650
|Extreme Cloud C25, C35, C2110, C5110, C5210, v2110
|AP 10.2.4.0, Cloud 20.1.1.3
|20-Jan-2021
|[[File:P2pdf.png|40px|link={{fullurl:Special:FilePath/i63_interop_extreme_cloud_10_2_4_0.pdf}}]]
|-
|AP310i/e, 410i/e, 460i/e, 510i/e, 650i
|Extreme WING NX 5500, 75xx, 9500, 9510, 9600, 9610, VX9000
|7.5.2.0
|12-Apr-2021
|[[File:P2pdf.png|40px|link={{fullurl:Special:FilePath/i63_interop_extreme_wing_7_5_2_0.pdf}}]]
|-
|AP 305c/305cx, 410c, 460c, 510c/510cx, 650/650x, 4000, 5010
|Extreme Cloud iQ
|AP 10.8.3.0, Cloud 25.4.3-40
|Aug-2025
|[[File:P2pdf.png|40px|link={{fullurl:Special:FilePath/i63_interop_extreme_cloud_10_8_3_0.pdf}}]]
|-
! colspan="5" |Fortinet
|-
|AP1010/1014/1020/822/832, APU221EV/U223EV/U321EV/U323EV/U421EV/U423EV
|MC1550/3x00/4x00/5000/6000 FortiWLC-50D ,200D, 500D, 1000D, 3000D FWC- VM-50, 200, 500, 1000, 3000
|8.5-2-5
|03-Jun-2021
|[[File:P2pdf.png|40px|link={{fullurl:Special:FilePath/i63_interop_fortinet_wlc_8_5_2_5.pdf}}]]
|-
! colspan="5" |Huawei
|-
|AirEngine5760-51/5760-22W/6760-X1/6760-X1E/6760R-51/6760R-51E/8760-X1-PRO/8760R-X1/8760R-X1E
|AirEngine 9700-M1, AC6508/6805/6800V, iMaster NCE-Campus
|V200R022C10SPC100
|10-May-2023
|[[File:P2pdf.png|40px|link={{fullurl:Special:FilePath/i63_interop_huawei_airengine_V200R022C10SPC100.pdf}}]]
|-
! colspan="5" |Juniper Mist
|-
|AP34, AP45
|Mist Cloud
|0.12.26354
|Aug-2023
|[[File:P2pdf.png|40px|link={{fullurl:Special:FilePath/i63_interop_juniper_0_12_26354.pdf}}]]
|-
|AP12, AP32, AP33, AP41, AP 43, AP61, AP 63
|Mist Cloud
|0.12.27139
|Feb-2024
|[[File:P2pdf.png|40px|link={{fullurl:Special:FilePath/i63_interop_juniper_0_12_27139.pdf}}]]
|-
! colspan="5" |Ruckus
|-
|SmartZone ZoneFlex R300, R310, T300, T310, R500, R510, H510, R600, R610, R710, R720
|SmartZone platform, vSZ-(H,E,D), SZ100/300
|5.2.0.0.699
|27-Apr-2024
|[[File:P2pdf.png|40px|link={{fullurl:Special:FilePath/i63_interop_ruckus_smartzone_5_2_0_0.pdf}}]]
|-
|SmartZone ZoneFlex R350, R350e, T350, R550, R650, R750, T750, R850, R500, R510, R610, R710, R720
|SmartZone platform, vSZ-(H,E,D), SZ144/300
|6.1.2.0.404
|29-Apr-2024
|[[File:P2pdf.png|40px|link={{fullurl:Special:FilePath/i63_interop_ruckus_smartzone_6_1_2_0.pdf}}]]
|}

=== DAS Compatibility ===
[http://en.wikipedia.org/wiki/Distributed_antenna_system Distributed Antenna Systems (DAS)] provide a cost-effective solution for extending radio coverage inside large facilities. Simply put, a DAS can be seen as a long cable starting at a base station or access point to which many antennas are connected. While the architecture can be utilized to mitigate certain coverage issues, the innovaphone IP73 was not designed to accommodate for such RF environments. Furthermore it is difficult to ascertain and ensure WLAN reliability in regard to interference, capacity, roaming, location-based services, and some important [http://en.wikipedia.org/wiki/IEEE_802.11n 802.11n] features, such as [http://en.wikipedia.org/wiki/Multiple-input_multiple-output MIMO]. As a consequence thereof, innovaphone will not endorse nor provide RF support for WiFi deployments over any Distributed Antenna System.

=== WPA3 Compatibility ===
The IP73 already supports the configuration option for ''WPA3''. However, this should not yet be actively used. 
''WPA3'' is currently only recommended for demo purposes. Support for ''WPA3'' is implemented, but no successful interoperability tests have been performed. WPA3 is not recommended being used except for demo purposes.

=== U-APSD Required ===
U-APSD is a power saving function that is always enabled on the IP73. It must also be enabled/supported on the AP to avoid packet loss/voice problems.

==Configuration==
IP73 configuration is done via WinPDM-application available at [https://store.innovaphone.com the Software section of the innovaphone App Store]. Use of desktop programming kit (IP62/IP64/IP65) (50-00060-021) is required.

=== Security ===
From version 7.x onwards, the IP73 firmware includes several changes to achieve compliance with the EU Radio Equipment Directive (RED) and the Cybersecurity Delegated Act.

This requires some additional configuration changes to get the handset operational:

====New handset initial configuration====
{{IP73_703_WinPDM_Auth}}

Resolution is to enter the [[#Shortcuts|default admin access code '''40022''']] and afterwards to either disable WinPDM Authentication or change the Admin access code:

[[Image:IP73 703 WinPDMAuth.png|ip73_703_winpdmauth.png/]]

====Configuration changes for PBX connection====
For handsets running firmware 7.x, the following settings must be configured via WinPDM in order to enable a PBX connection:
* Unite connection mode must be set to another value than ‘Automatic’ at [Device/Unite/Connection mode].
* Admin access code must be set at [Device/General/Admin access code]. 5 - 10 characters required.
* Phone lock code must be set at [Device/Settings/Force phone lock]. 4 - 8 characters required. By setting the phone lock code the phone lock will be applied for every subsequent bootup. Phone lock is enforced on by default but can be turned off by parameter [Device/Settings/Force phone lock] or by admin menu in handset GUI. Note that handset does not comply with RED by turning off forced phone lock!
* Security has also been strengthen by disabling some outdated security protocols by default. If a service is no longer working after upgrade try to use more modern cryptographic protocol or set parameter “<service>/Allow outdated security protocols” to ‘Yes’.

===PBX Registration===
====Authentication via client certificate====
The recommended way to register an IP73 handset at the innovaphone PBX is SIP over TLS with authentication by a client certificate. The IP73 handset is delivered with a preinstalled device certificate already trusted by an innovaphone PBX.

Prerequisites on the PBX for such type of authentication are:

*The issuer of the IP73 client certificate is on the Trust List of the PBX gateway
*The CN of the client certificate used by IP73 equals the MAC address of the IP73 itself (alternatively other CN and registration identity can be used)
*User Object contains a Device with a Hardware Id matching the MAC address of the IP73

On the IP73 following settings must be configured:
*VoIP->SIP
**SIP TLS client certificate: <select certificate with MAC address as CN> or <Automatic if preinstalled certificate is used>
**SIP Transport: TLS
**Primary SIP proxy: <IP-address of the PBX> or <DNS-name of PBX>
**SIP proxy ID: <PBX system name>
**SIP proxy password: <no password is required>
**Registration and Authentication identity: MAC address

====Authentication via username/hardware id and password====
*VoIP->General->Endpoint ID: username or hardware id on User Object
*VoIP->SIP
**SIP Transport: TCP or UDP
**SIP proxy password: <password on the User Object or PBX System password, depending on Users Device configuration>
**Registration and Authentication identity: Endpoint ID

=== ICE/TURN ===
ICE is enabled by default. It is required to provide STUN and TURN server configuration under VoIP->General to secure correct negotiation of media channels.

=== Factory Reset ===
You can use the local ''Admin menu'' on the Phone or the WinPDM Software (Rightclick on the device) to make a Factory Reset.

=== MWI for IP73===
The IP73 can be configured to display a message waiting indication / MWI.
You need a programming shell and the WinPDM software (available for download in our [https://store.innovaphone.com/release/141A000/download.htm Store] under the Software tab).
*Connect programming cradle to the administration PC
*Install WinPDM and start the application
*Place IP73 into the programming cradle
*If the IP73 is recognized in WinPDM, the parameter settings can be opened by switching to the Numbers tab (1)
*select the respective device type (2 -> WH2 = IP73) and double-clicking the device line (3).
*Select menu Device (4) and step to Message Centre (5)
*Insert the number of the voicemail object for the Message Centre Number (6)
*Insert the user number for the voice mail number (7)
Confirm settings with OK and ensure correct synchronisation of config changes to the handset. Reset of handset is recommended.

[[Image:WIFIMwi.PNG|wifimwi.png/]]

===Central Phonebook Access===
The device offers access to a central LDAP-based directory. Following configuration steps have to be carried out by the administrator:

'''Device Configuration via the WinPDM application'''
* Device has to be plugged into programming cradle and edited via WinPDM
* Device has to be operated with at least firmware '''6.1.13''' available at the [https://store.innovaphone.com innovaphone store].
* Open section Device and step to Central phonebook. Change the central phonebook mode to LDAP and enter the appropriate parameters for the ldap directory to be queried.

For innovaphone PBX query, the following settings and attributes can be used and adapted to the PBX setup.

[[image:IP73_PBX_query.png|ip73_pbx_query.png/]]

In case of using LDAP-secure-queries, upload of the LDAP-server-'''ROOT''' certificate to the IP73 trust list is required:

[[image:IP73_Certificate.png|ip73_certificate.png/]]

==Troubleshooting==
Log Options can be configured in the WinPDM software, under Device->Log.

===Remote PCAP Tracing===
You can activate the remote PCAP interface and Trace flags directly in the phone configuration (Admin Menu :: Logging :: Mode) or via WinPDM under Device->Log->PCAP capturing: RPCAP.

Only IP traces are available via RPCAP, no innovaphone or device internal traces are logged.

===PCAP to file via USB Tracing===
It is possible to store PCAP trace file in the ''pcap'' folder on the handset by setting in the phone configuration (Admin Menu :: Logging :: Mode) or via WinPDM under Device->Log->PCAP capturing the option "PCAP to file".

To access the file set Device -> General -> USB behavior to "Ask" and select "File transfer", when connect the handset to the WinPDM. Navigate to the folder ''pcap'' on the ''Handset diagnostics'' drive.

===Trace Options===
Following additional trace options are available:

*WLAN Trace
*Configuration Trace
*GUI Trace
*GLI Trace
*Unite Trace
*VoIP Trace
*System Trace
*Protector Trace
*SaS Trace
*Bluetooth Trace

The resulting traces are available via USB file transfer and are encrypted. The encrypted log files can be encrypted by support only.

===Logging via Syslog, SFTP or logfile===

The handset can be configured to send Syslog messages to a Syslog server, an SFTP server or to a local logfile located in the folder ''tracelog''.

The configuration is available via WinPDM Device -> Log -> Syslog or SFTP.

===Handset Error Messages===

====No network====
The ''No network'' message indicates missing WLAN connection. It can be caused by wrong settings for SSID, Security, reg. domain and WLAN channels or lack of coverage.

====No access====
The ''No access'' message is caused by missing IP connectivity to the PBX or wrong configuration for authentication at the PBX.

== Shortcuts ==
There are some hidden tools for information and analysis, which can be accessed via specific menus and codes:

;Handset Device Information
:''*#34#'' in the main display

;RSSI Indicator
:''*#76#'' in the main display. Type again to exit.
: Here you find the following information in the display:
:* Line 1: SSID
:* Line 2: Current AP
:* Line 3: Current AP MAC
:* Line 4: Previous AP
:* Line 5: Previous AP MAC

;Site Survey Tool
:''*#77#'' in the main display.

;Admin Menu
: Go to the ''Settings menu'' and type in ''40022''

==Known Problems==

===Packet loss and voice quality issues with non-tested WLAN AP and IP73===

'''Issuer: Ascom'''

'''Published: 2022-12-07'''

'''Background''' 
It has come to our (Ascom) knowledge that in later Aruba software versions than Ascom-certified v.8.7.1.1 there is a critical issue affecting clients using power save (U-APSD). 
Data packets will not be transmitted properly to clients in power save.

'''Affected Ascom Certified Aruba Access Points:''' 
7000/7200/9000/MX-VA-xxx Controllers 
AP-303, 304, 305, 314, 315, 324, 325, 334, 335, 344, 345, 
504, 505, 514, 515, 534, 535, 554, 555, 635 

'''Typical symptoms are:''' 
Poor voice quality issues. 

'''Workaround''' 
Currently none available. Disabling U-APSD on the SSID isn’t a viable workaround as this is a requirement for Ascom i63 handsets in enterprise-grade VoWi-Fi deployments. 
Thus it is strongly recommended to avoid upgrades to v. 8.9.x and higher at this point. 

'''Solution''' 
Update Aruba equipment to ArubaOS-8.10.0.11, see [https://arubanetworking.hpe.com/techdocs/ArubaOS-8.x-Books/Release-Notes/810/ArubaOS-8.10.0.11-Release-Notes.pdf Aruba Release notes (search for Ascom)] for details.

===Bluetooth automatically disabled===

'''Issuer: Ascom''' 

'''Version''' 
Handset Firmware 4.0.6

'''Detailed Information''' 
If you have enabled Bluetooth over WinPDM and you want to configure (establish connection to the headset), you get the message "Bluetooth automatically disabled".

'''Background''' 
The chip responsible for handling wireless radio communication, WLAN and BT, has a bug in its current firmware. Thus, using WLAN and BT on similar frequency bands does not work well.

'''Solution/Workaround''' 
Bluetooth is prohibited to be used when WLAN band 2.4 is in use by being automatically disabled. Bluetooth can only be used when WLAN on the 2.4 GHz band is inactive. 
You can disable WLAN 2.4 band over the WinPDM tool.

==Related Articles==
*[[IP73 Technical Data EN]]
*[[Reference:IP62 WLAN WiFi Wireless IP-Phone]]

Reference:My Innovaphone

2026-07-30T07:40:20Z

Vsc: /* Support */

==Where is my old my.innovaphone?==
Don't worry, just login with your old my.innovaphone account! You will be asked to confirm your forename and surname (just a '''natural person''' is allowed) and accept some terms and conditions. 
Afterwards you find the old license/device view inside the [[#Licenses tab| Licenses tab]].

==About==
my.innovaphone allows the handling of licenses and includes the handling of device warranty and software service agreements. 
You can also sign contracts here for different purposes.

===Project-View===
My innovaphone offers the possibility for several users to be in one company. This company shares its balance of licenses over all users and can have several projects. Projects have their own balance of license types and devices are bound to a project.

===Language===
My innovaphone will support multiple languages. You can select your desired language at the top of the page. 
Currently supported languages:
* English
* German
* Italian
* Dutch
* French
* Spanish (partially)
* Polish (partially)

===Guides===

====Quickstart guide====
[https://my.innovaphone.com/docs/my_innovaphone_Quick_Start_Guide_nl.pdf Dutch quickstart guide] 
[https://my.innovaphone.com/docs/my_innovaphone_Quick_Start_Guide_en.pdf English quickstart guide] 
[https://my.innovaphone.com/docs/my_innovaphone_Quick_Start_Guide_fr.pdf French quickstart guide] 
[https://my.innovaphone.com/docs/my_innovaphone_Quick_Start_Guide_de.pdf German quickstart guide] 
[https://my.innovaphone.com/docs/my_innovaphone_Quick_Start_Guide_it.pdf Italian quickstart guide] 

====SSA guide====
;V10 and greater:
* [https://my.innovaphone.com/docs/innovaphone_SSA_Leitfaden_V10nl.pdf Dutch SSA guide] 
* [https://my.innovaphone.com/docs/innovaphone_SSA_Leitfaden_V10en.pdf English SSA guide] 
* [https://my.innovaphone.com/docs/innovaphone_SSA_Leitfaden_V10fr.pdf French SSA guide] 
* [https://my.innovaphone.com/docs/innovaphone_SSA_Leitfaden_V10de.pdf German SSA guide] 
* [https://my.innovaphone.com/docs/innovaphone_SSA_Leitfaden_V10it.pdf Italian SSA guide] 
* [https://my.innovaphone.com/docs/innovaphone_SSA_Leitfaden_V10pl.pdf Polish SSA guide] 
* [https://my.innovaphone.com/docs/innovaphone_SSA_Leitfaden_V10es.pdf Spanish SSA guide] 

;V8 and greater:
* [https://my.innovaphone.com/docs/innovaphone_SSA_Leitfaden_en.pdf English SSA guide] 
* [https://my.innovaphone.com/docs/innovaphone_SSA_Leitfaden_fr.pdf French SSA guide] 
* [https://my.innovaphone.com/docs/innovaphone_SSA_Leitfaden_de.pdf German SSA guide] 
* [https://my.innovaphone.com/docs/innovaphone_SSA_Leitfaden_it.pdf Italian SSA guide] 

==First steps==
Open [https://my.innovaphone.com my.innovaphone.com] and click the "I would like to create a new personal user account" link.
Enter your personal data and register.

You will receive a registration email with an activation link.
After account activation you have two options:
* create a new my.innovaphone company with the "Create company account" button
* ask another user of your company to invite your email address to an already existing company

If you accidentally created an own my innovaphone company, just ask another user of your company to import your just created company.

If you create a new company, you can '''optionally''' enter your innovaphone account ID (which is your customer number with innovaphone) with your postal code, to retrieve your company data.

Inside the license tab of the my.innovaphone portal, you will see a help link at the right side of the horizontal tab menu.
This link shows the corresponding text of the wiki section, when hovering with the mouse over it,
and redirects to the corresponding wiki menu, if clicked.

It is possible, that one user is member of serveral companies!

==Left bar==
If you open the left bar, you have the options to:
* select one of your companies
* edit your personal user account
** user name
** email address
** flag to recieve SSA expiry emails
** password
* create a new company
[[Image:Myinnovaphone bar.png|center|thumb|200px|myinnovaphone_bar.png/|myinnovaphone_bar.png/]]

==Main tabs==
Inside each company you see the three main tabs:
* Contracts
* Authorized persons
* Licenses (see [[#Licenses tab| Licenses tab]])

You may also have two buttons:
* Add Contract (just as company administrator or with the contract right)
* Invite person (just as company administrator)

[[Image:Myinnovaphone main.png|center|thumb|200px|myinnovaphone_main.png/|myinnovaphone_main.png/]]

=== Contracts ===
Inside the contracts tab, you see all your contracts and you can download these conracts. 
In general, contracts must be first approved by innovaphone, so you see three types of contracts:

* open contracts which must be approved by innovaphone first
* approved contracts which can be already used
* cancelled contracts which are not valid anymore

[[Image:Myinnovaphone contracts.png|center|thumb|200px|myinnovaphone_contracts.png/|myinnovaphone_contracts.png/]]

These type of contracts currently exist:
==== innovaphone myApps Cloud Service ====
Conclude this contract to use the innovaphone myApps Cloud.

==== innovaphone software rental ====
Conclude this contract to rent innovaphone software products. You must conclude this contract if you want to use the software rental inside the Devices App.

=== Authorized persons ===
Here you see all persons which exist inside your company. Each person can have the following rights:
* Administrator (everything)
* Contracts (can conclude contracts)
* Licenses (can work with licenses)
* Viewer (can just see everything without doing something)
* Locked (cannot even login to this company anymore)

=== Licenses ===
Here comes the old my.innovaphone view which allows the handling of devices, licenses, activation keys etc.

==Search (inside licenses tab)==
At the right top of the licenses tab you have a search field. You can search for different things:
* Devices (part of a device name or device comment)
* Projects (part of a project name or project description)
* Own activation keys (part of an activation key or its description)
* Hardware rental orders (part of the innovaphone order number or your own order reference or a MAC address of an order)

You have to enter at least '''three''' chars to start a search. To search for activation keys,
you have to enter at least '''five''' chars.
* Search for license types. Enter e.g. "PBX-Port8" to find all devices with Port8 licenses or enter "PBX-Port8=100" to find all devices with Port8 licenses '''>=''' 100.
* Search for products, e.g. 01-00811 für IP811 (such a search may take longer!)

==Licenses tab==
===Projects===
After creation of an own company, you will have a default project named "DEFAULT". You can rename this project later.
You can also create more projects on the projects page with "Create".
Each project of a company must have a unique name.

Do '''not''' set SSA, if you want to import your devices from your old license manager account first.
If you want SSA and you '''won't import''' devices into this project from your old account, you should set SSA at once.

You can select a certain project by activating it in the project list. This selection is then true for all other pages, as some pages require a selected project.

[[Image:overview.jpg|center|thumb|200px|overview.jpg/|overview.jpg/]]

By activating a project by clicking on the project name in the project list, you can manage this project and its settings.

==== Rental project ====
You can also manually create a rental project. A rental project is normally created automatically by uploading an activation key inside the Devices App. 
But if you want to start directly with an Automatic iSC reloading service, you'll need to create the project manually. 
Take care that the name '''equals''' the domain name in your Devices App. 
 
If the rental tab in your Devices App domain doesn't show the expected balance/Automatic iSC reloading contract/licenses etc., you may use the Devices App Guid Link mechanism to link the domain to this specific project (see below) (use Devices App '''13r3 SR12''' or higher!).

====Properties====
Rename the project or/and change its description. 
 
You can configure further CC mail addresses inside your '''License Purchase''' project, if you have one. If you purchase licenses on credit, the emails will be also sent to theses addresses.
 
 
Since version 10, an innovaphone device will automatically connect to http://config.innovaphone.com/init
This script looks at the project properties of the project, where the device exists. 
You can configure an update '''URL''' and a '''trusted certificate'''. 
 
;Devices App GUID link: This is a GUID which can be entered in the settings of a domain inside the Devices App to link the domain to this specific project, if the names do not match and/or the Devices App has been setup from scratch. The Devices App must use the customer to which this projects belongs to be able to use this GUID.

====Software Service====
You can put your project under SSA (software service agreement).
You will be asked to enter a SSA end date. This will be the date, where all SSA licenses of all devices in this project will expire.
The end date mustn't be more than one year in the past. 
Optionally you can enter a maximum SSC amount. The SSA end date will be automatically calculated then. 
If you have entered a maximum SSC amount, you have to use the '''Recalculate''' link to calculate a new SSA end date,
if you change your license selection.
 
You can also calculate SSA over all projects at once. In this mode, you '''won't be able''' to confirm the calculation. You'll just see the necessary SSC amount.

After entering a date/SSC amount, you will get a summary of all licenses, which will be put under SSA and the amount of needed SSC licenses.
The SSC value for each license is calculated by the bind date of the license and the entered SSA end date/SSC amount.

[[Image:Ssa_extend.jpg|center|thumb|200px|ssa_extend.jpg/|ssa_extend.jpg/]]

If you have licenses for an older version than the current version, you have to pay SSCs from the [[#Release dates|release date]] of the next version of the current license version. 

e.g. you have a V7 PBX-PBX7#15 license with bind date 1/1/2010. Version 8 was released on 7/12/2009, so SSA is
calculated from 7/12/2009 for this license. You will see the calculation date in the list under "bind date"

If licenses already have a SSA date, just the difference between the current SSA date and the entered SSA end date must be paid.
If the bind date of the device lies in the past, the difference between the bind date and the current date must be paided twice (this is the column 'days*2'). 
If your license is under SSA, which is already over, you also have to pay the time between the old SSA date and the current SSA end date twice.

Here is a short example, how the days are calculated:

Bind date: 24/06/2009 
Current date: 31/08/2009 
SSA end date: 12/12/2011 
 
You will have to pay from 24/06/2009 to 31/08/2009 twice for 68 days.
From 31/08/2009 to 12/12/2011 you will then have to pay the normal price for 833 days.

You can also select for each license, if you want SSA for it or not. If not, no SSC is needed and no (new) SSA end date is set for this license. 

You can preview the SSC calculation for another calculation date. Simply change the dropdown
selection to get the new SSC value.
Of course you can't confirm this calculation for another date, just for the current date!

''You may add additional licenses to the calculation, which you will bind later''. Just click on the '''+''' near this text and you can add
multiple licenses, which will be added to your calculation after using the recalc link. Listed are licenses of the current version and from
your balance.

After confirming your entered SSA end date, each license will have this date as SSA end date and can be downloaded in all versions of this SSA time.

You can now extend the projects SSA end date like as setting a new one.
The resulting summary is the same as above.

If your user account has the right to buy licenses on credit, just check the checkbox.
You may enter an order number, which you can use for your order, if you buy on credit.

=====Past SSA end date=====

You can configure a new SSA end date in the past, if you accidentally configured a wrong date. 
No licenses will be changed, if you configure a date in the past, just the SSA end date of the project!

=====SSA Expiry Mail=====

If project SSA will expire, each company user will receive a reminder mail '''7''' weeks before and
then every week one mail.
You can disable these mails with the checkbox 'Send SSA expiry mails'.
Note that every user can configure, if he wants to receive mails or not in his account settings.

If you want the end user of the project to receive an expiry mail, you can configure a '''reseller''' mail address and end user mail addresses. These end users will then receive an email, 30 days before the project will expire. The default text is:

Your Software Service Agreement for your innovaphone PBX in project "{$arg[3]}" will expire in {$arg[1]} days.
Please contact your reseller {$arg[2]} to upgrade the license. 
The upgrade of the license is important to secure the phone system!

You can change this text as you want. You can use placeholders:
* '''{$arg[1]}''': days left
* '''{$arg[2]}''': reseller mail address
* '''{$arg[3]}''': project name
 
You can also define a global text for all projects under your [[#Company| Company settings]].

You can optionally configure to receive project SSA independent reminder mails for each license of a device [[#Company 2|here]].

=====Automatic SSA Extension Service=====

You can request an automatic SSA extension service for a project, which is under SSA. By following this link, you will have the opportunity to request a callback and/or the necessary agreement as PDF file.

All licenses have to be under SSA to use the automatic SSA extension service!

There are some basics to know, if a project is under automatic SSA:
* If you bind new/free licenses, they'll get SSA until the current project SSA date and you will receive an invoice for the SSCs
* If you move devices into this project, their licenses will get SSA until the current project SSA date and you will receive an invoice for the SSCs
* You can't join this project into another project, but you can join another project into this one

====Rights====
=====Own project=====
Add or delete company rights for this project. To add a company right, you have to enter the company id of this company.
Each user of a company with rights on this project can add devices, licenses, activation keys to this specific project, but is restricted in removing devices, editing the project and can't create activation keys with the projects balance.

The company id can be found under Licenses->company and the company tab.

[[Image:Project_rights.jpg|center|thumb|200px|project_rights.jpg/|project_rights.jpg/]]

=====External Project=====
If another company granted access rights to a project to you, you can unsubscribe from this project here.

====Import====
The import has been disabled. All old devices are already imported and can be added to your project manually.

====Join====
Here you can join your currently selected project with another project, which you select from a dropdown box. 
If the other project has SSA, you'll see the current SSA end date, which you might change for the join process and you will get a list of all licenses, which might be updated to the ssa end date/changed date of the other project. The list equals the list shown under [[#Software Service|Software Service]].

The selected project will be automatically deleted after the join. You can't join a project,
if it grants external rights to another customer. Delete these rights before.

You can't change the SSA end date, if the other project is under automatic SSA! You will receive an invoice for SSCs used for the join.

====Project Move (admin only)====
A company admin can move a project with its devices, activation keys, balance etc. to another company. You have to know the company ID from this company, which can be found under Licenses->Company and the company tab. 
The history won't be moved!

Projects with negative balances can't be moved!

Existing project rights will be deleted.

====Delete====
Delete the project. Only possible if it has no activation keys, project rights, devices or user rights.
 
You may [[#Join|join]] your project into another one, if you can't delete it.

====Project Freed_RMA_licenses====
If you see a project with this name in your project list, you had a RMA device with not yed moved licenses, which was shipped to innovaphone and reshipped to another customer. 
The licenses of such a device have been moved into the pool of free licenses of the project Freed_RMA_licenses, from where you can assign them to another device.

====Rental====
Projects starting and ending with the '''$''' sign in their name are rental projects. 
The name corresponds to the domain name of a Devices App installation. 
 
All software licensing and device management can be just done through the Devices App itself, see [[Reference13r1:Concept_App_Service_Devices#Rental_program_and_Payment_method]]. 
Just '''hardware licenses''' still need to be bound inside my.innovaphone currently and have to be downloaded there and uploaded on the device itself just as usual.

===Balance===
On the balance page you will see the balance of the currently selected project or the balance of all your projects together.
The balance is bound to your company and '''not''' to your user account. The balance is bound to a specific project, but can be shared for license creation or activation key creation if wished. 
Sharing the balance over several projects is not possible in external projects!

[[Image:Balancepage.jpg|center|thumb|200px|balancepage.jpg/|balancepage.jpg/]]

====Free licenses====

Here you see a list of all your free licenses. If you return licenses from one of your devices, the returned licenses are stored in your free licenses pool. You can assign these licenses to another device (see [[#Add licenses from free licenses|'Add licenses from free licenses']]).

[[Image:Balance_free_lics.jpg|center|thumb|200px|balance_free_lics.jpg/|balance_free_lics.jpg/]]

The bind date, SSA end date and the external key (like DECT-Multi-Cell-Ari) are stored for each license.

===Activations===

You'll see a list of all your bound activation keys with their licenses here.

[[Image:Activations.jpg|center|thumb|200px|activations.jpg/|activations.jpg/]]

====Add an activation key====
To increase your projects balance, select one of your projects, follow the "Add" link and enter the activation key in the corresponding field. You can also enter an optional comment for this key. You will then get a listing of all contained licenses. After commiting this key, your project balance will have been increased by the keys values.

"Deselect the current project" to view all activation keys independent of the selected project.

====Search for an activation key by your order number====
Enter your own order number (or nothing), to view your activation keys for this order.

====License certificate====
You can always download the innovaphone license certificate for activation keys in your projects. Simply press the download link in the list at the right side.

===Own Activations===
Here you'll see a list of all created activation keys in the selected project (or over all projects).

You can create activation keys on the project page for other users/companies or to simply transfer licenses from one project to another. 
You can enter a comment, an order number and an order reference. The '''order number''' is your own order number for the key and the '''order reference''' is the reference number of the customer, who receives the newly created key. 
The order reference and order number will be shown in the innovaphone license certificate.

[[Image:Created_activations.jpg|center|thumb|200px|created_activations.jpg/|created_activations.jpg/]]

You have to select an activation key in the activation key list to update or delete it.

Updating and deleting a key is only possible, if this key is not assigned.

====Update====
Add more licenses to this key or change its comment, order number and order reference. 
You can also remove licenses by entering e.g. -2, if you want to remove 2 licenses from the key.

[[Image:Own activations update.jpg|center|thumb|200px|own_activations_update.jpg/|own_activations_update.jpg/]]

====Delete====
Delete this key. Its licenses will go back into the balance of the currently selected project.

===Devices===
To view your devices you first have to click on the "Show" button. You can leave the filter field empty if you want to view all your devices.

[[Image:Devices_page.jpg|center|thumb|200px|devices_page.jpg/|devices_page.jpg/]]

Red marked device names are devices, which are currently in RMA.

MAC addresses of RMA devices do not longer start with 01-...

====List====
A List of your devices in the currently selected project. 
You can deselect the current project/device to list all your devices.

Select a certain device from the device list, to manage its properties, licenses etc.

Actions on multiple devices:
* Move: move several devices into another project at once (see [[#Move device|Move Device]])
* Remove: remove several devices at once (see [[#Remove|Remove]])

=====Add=====
Follow the "Add new devices" link on the devices page.

There you have a few options:
* You can add a single new device
* You can add devices according to a mac address range (e.g. from 00-90-33-08-20-00 to 00-90-33-08-22-00), maximum 50 at once
* You can add devices by uploading a text file with mac addresses like this (maximum 50 at once, each line one mac):

00-90-33-08-20-20
00-90-33-08-20-21
00-90-33-08-20-22
00-90-33-24-20-20

* You can add devices according to your received order number. Just enter you order number and you will get a list of all devices bount to this number.

Note: MAC addresses can be always given like this:
* 00-90-33-xx-xx-xx
* 00:90:33:xx:xx:xx
* 009033xxxxxx
* xxxxxx (00-90-33- will then be added automatically)

There might be errors, if you try to add a device. They are explained [[#Image explanation|here]].

As the device warranty will be handled by licenses now, you can also add telephone devices
to your projects.

=====Add warranty extensions=====

Here you can add warranty extension licenses for all devices in the currently selected project. 
You'll get a list of all devices with the corresponding license type(s) and you can specify the years for each device (or for all devices by entering the number in the list header). 
After confirming your selection, you'll get an overview of all needed licenses, which you have to confirm too. 
Note: Warranty extensions are delivered via an Activation Key (ACT-xxx), as they are licensed items that can be ordered from us. Please remember to charge your balance with an activation key containing either a GVL-Purchase or
GVL-Within-Warranty license items (under Activations menu) .

=====Check licence, SSA and warranty status of a device=====
Here you can list licenses with ssa and the warranty end date of a device, which is not in one of your projects. 
For this option to work, you have to link your innovaphone customer ID (5 digits) to your my.innovaphone company. (As the warranty is also the one we grant to our distributors, we don't want to get an end customer confused.)

=====Download devices of an order as CSV=====
Enter an order number to retrieve all devices for this order in a CSV file.

=====Download devices of an order as PDF with barcodes=====
Enter an order number to retrieve all devices for this order in a PDF file with a barcode for each MAC address. 
Der Barcode ist vom Typ C128B.

====Properties====

Change the name and comment of a device.
You can only change the name, if it's no MAC or IPEI.
 
Here you have also the possibility, to directly request RMA for this device with prefilled values.

====Licenses====
Here you can add, download or move licenses.

=====Add licenses from balance=====
To create new licenses for a device, you have to add this device first on the devices page and then select a version of the license
and whether you want to summate the current licencing. If you select current licenses, then older licenses for example V6 or V7 licenses will also be counted as V8 licenses in the next overview. This is necessary if you want to license a V6 unit with V8 licenses, but still want to use it as V6.
After that click "Next".
On the next page you will see a list of all available license types, which depends on your current available license types, of the selected license version and the device type (IP6000, IP800 e.g.):
[[Image:licenses.jpg|center|thumb|200px|licenses.jpg/|licenses.jpg/]]
 
If your project has a SSA end date, which is not yet over, you'll have the possibility to set SSA for the new licenses to this SSA end date or you can optionally change this date to another one for the new licenses.
 
You see the available project balance, the balance over all projects (excluding external projects), the currently installed licenses and the maximum amount for this device type. You can now enter the value of the new license.
Base/Upgrade licenses can be selected via dropdown box.
'''Voicemail and Standby lics must always have the same amount as the selected PBX-PBX... license!
The maximum amount of PBX-Registration licenses equals the amount of the selected PBX-PBX... license!'''

The whished overall amount of pbx version 8 and above licenses can be specified here and the concrete amount of license sub types will be requested on the next page.

You can preview the SSC calculation of the wished licenses without having them in your balance.

[[Image:licenses2.jpg|center|thumb|200px|licenses2.jpg/|licenses2.jpg/]]

The best (cheapest) combination of each v8 pbx license type is already filled in, but you might change the amount of sub types if your does not fit and you do not want to purchase new activation keys for the sub types.

The column SSC/Unit is just shown if your project is currently under SSA and you have entered a SSA end date.

The SSC multiplicator is the value, which you have to multiplicate with each license unit to get
the corresponding SSC amount.
E.g. if you have 20 units of PBX-Port8*20 licenses with a SSC value of 54 and a multiplicator of
1.0000 (which equals to 365 days) you have to pay 20*54*1.0000 ~ 1080 SSCs.

 If you create licenses for an older version than the current version, you have to pay SSCs from the [[#Release dates|release date]] of the next version of the currently selected version twice. 
e.g.: you want to bind licenses for V6 with SSA, so you have to pay SSCs from the release date of V7
 You can also select for each license, if you want SSA for it or not. If not, no SSC is needed and no (new) SSA end date is set for this license. 

You can't change the SSA end date, if the project is under automatic SSA! You will receive an invoice for SSCs used for the new binding.

Now confirm your new selection. If you have not enough licenses in your current project, but there are still licenses in other projects, you will get a dropdown box with a list of all projects containing the needed licenses. You can now select all desired/needed projects and confirm your selection again.
The balance of all selected projects will then be decreased by the needed amount.
 
 
If your user account has the right to buy licenses on credit, just check the checkbox.
 
You may enter an order number, which you can use for your order, if you buy on credit.

=====Add licenses from free licenses=====

Here you can assign licenses, which you returned from other devices.
You will also have to select the desired version and will than get a list of fitting licenses according to the current device and selected version.

[[Image:licenses_free.jpg|center|thumb|200px|licenses_free.jpg/|licenses_free.jpg/]]

If a license is under SSA, the correct license type is shown in column 'License Type' besides the 'Original Type'.
On confirming the selection, a consistency check is done (e.g. only 4 Relay-PRI licenses on an IP6000).
Bind and SSA end date will be maintained for each license.

As external keys are also maintained, you can select e.g. an old Dect-Multicell-Ari license to have the same ARI on another IP1200.
 

If your project has a SSA end date, which is not yet over, you'll have the possibility to set SSA for the new licenses
to this SSA end date or you can optionally change this date to another one for the new licenses.
You will have to confirm this after your first license selection (this is the same calculation as [[#Software Service|here]]).

You can't change the SSA end date, if the project is under automatic SSA! You will receive an invoice for SSCs used for the binding.

=====Add V7 floating license (slave pbx)=====
Here you can add a V7 floating license for a slave pbx. A device with a floating license can't have V7 pbx licenses and a device with V7 pbx licenses can't have a floating license.

=====Delete V7 floating license=====
Here you can delete an already existing floating license, if you won't use it anymore.

=====Add warranty extension licenses=====
Extend your warranty by adding warranty extension licenses:

[[Image:add_warranty.jpg|center|thumb|200px|add_warranty.jpg/|add_warranty.jpg/]]

If you add the warranty extension (GVL-purchase) immediately after the receipt of your device,
you can add the cheaper warranty extension licenses, otherwise you'll have to add
the more expensive ones (GVL-within-warranty).

Note: For the GVL-purchase you have 6 weeks from receipt of the delivery note from innovaphone, after the 6 weeks it will not be possible to bind the GVL-Purchase, you will need to switch with the GVL-within-warranty.
You can extend the warranty for a maximum of four years.

=====Download licenses=====

[[Image:Device_download.jpg|center|thumb|200px|device_download.jpg/|device_download.jpg/]]

You will get a dropdown with all available versions. Versions are dependent of your device, your licenses and of the ssa of your licenses. 
'''From V9 on''', you just have one option, which will create a license file, which contains the licenses upgraded to the highest version of their type. 
You are able to download downgraded versions of your licenses. E.g. if you have only V8 licenses, you can download a V7 license file (same restrictions as below).

Downgrades or only possible down to version 6!

If you do not want to download licenses by version, you have to decide whether to download the licenses encrypted or not.
'''If you download the licenses unencrypted, you won't be able to return those licenses anymore.'''
So you won't be able to return licenses for devices with V5-V7 licenses, as licenses for these versions are not encrypted.
To return these licenses, you will have to upgrade to a new bootcode, which prevents firmware downgrades to versions below version 8. 
Encrypted licenses are stored in a xml file, which you can then upload on your V8 (or higher) device.

You can now also download licenses directly from by the web interface of a device.
You just have to enter your account data and start downloading the licenses from my.innovaphone.com
without having to download/upload a license file.

=====Download test licenses=====

Obsolete, use manage test licenses now

[[Image:Device_download_test.jpg|center|thumb|200px|device_download_test.jpg/|device_download_test.jpg/]]

You can also download test licenses if you want to run tests. You will be asked, which version you want to use, whether the device is used as slave and if not used as slave, how many pbx licenses you want to use.

'''Important: Since V11, trial licenses are valid for 3 months and can be released once for a dedicated device. After expiration of those 3 months no further trial license creation for this device is possible.'''

V5 does '''not''' support test licenses!

=====Manage test licenses=====

You can assign dynamic test licenses to your device which will be always valid for 14 days with an amount of 10.000.
If you download your standard licenses or test licenses here, you will get both together in one download as long as the test licenses are still valid.

* if a test license expires, your PBX will reboot
* you can request an extension of your test licenses inside the test license settings plugin of your settings app or here too
** innovaphone will contact you upon your extension request

=====Download App development license=====
If you're an App developer, you have the possibility, to generate a real license for you Apps which will contain your manufacturer prefix. 
The manufacturer prefix has to deposited at your my.innovaphone company by innovaphone before you can use this feature.

You can just have up to '''three''' different devices per company for which you can create such licenses!
These licenses aren't allowed for production usage!

You see your already used MAC addresses on this page too if you already created such licenses before.

If your manufacturer prefix is '''innovaphone''', you can enter license names like:
* App(innovaphone-app1)15
* Service(innovaphone-app2)15

=====Move licenses to another device=====
If you have the needed account rights or the device is already in RMA, you can move licenses to another device. After moving licenses, the former device will be marked as a RMA device.

You can just move licenses to devices without licenses!

=====Mix of rental and purchased licenses=====
From '''13r2 SR12''' onwards you can mix rental and purchased licenses. 
A device with rental licenses will be always inside a rental project (you recognize such a project by it's starting and ending '''$''' in the name). 
You can now add licenses from the balance to a device in such a rental project. 
 
If you invalidate lifetime licenses on such a device, just purchased licenses are returned. Rental licenses stay bound until you remove them inside your Devices App! (under rental menu)
Inside my.innovaphone you will always see both rental and purchased licenses. Inside the Devices App, you will just see the rental licenses. 
 
You must download and/or install the purchased licenses as usual. 
 
A 13r1 PBX or a PBX with an older SR will just recognize rented licenses!

If your PBX is already inside a non rental project, it will be automatically added to a rental project if you add rental licenses. You then may have the device in two different projects (one rental, one normal), which is no issue.

====Move device====
Here you can move the current device or the selected devices to another project. 
If you select a SSA project, you can change the SSA end date for the move process. 

If the other project is under SSA, you will first see a SSC calculation, which you have to confirm,
as the SSA date for each SSA license will be extended until the given SSA end date
(this is the same calculation as adding SSA to an already existing project, see [[#Software Service|here]]).

You can't change the SSA end date, if the other project is under automatic SSA! You will receive an invoice for SSCs used for the move.

====Invalidation====
====Returning of licenses====

By the invalidation, licenses are returned to the free balance of the project to which the device belongs in the Portal my.innovaphone. 
You can then bind the licenses from the free balance to another device.

=====Requirements=====
* V8 or higher
* access to the webinterface
* a device certificate
* my.innovaphone login credentials
* '''no IPVA device'''
* no 'In House' licenses

=====Informations=====

You can invalidate V8 (or higher) licenses by uploading the XML file, you got from your device or by returning your licenses over the web interface of your device ([[Reference12r1:Configuration/General/License]]), in order to return [[Reference15r1:Licenses#Gateway Licenses|PBX licenses]] back to the free balance.

V7 licenses can be just returned, if you agree, that you won't be able to downgrade below V8 anymore. You will need a new bootcode, to use this function. '''You need a V8 firmware or higher for invalidation.'''

If your device has access to my.innovaphone.com, you can also invalidate licenses directly from the web interface of the device.

[[Reference15r1:Licenses#Gateway Licenses|Gateway licenses]] and warranty extensions won't be returned to the balance and remain to be assigned to the device!

The licenses needn't be present on the local device to perform the invalidation!

SSA are bound to the license and not lost when performing invalidation.

=====Process=====

Steps to invalidate licenses, if your device has internet connectivity:
# on the web interface of the device go to General->License and follow the my.innovaphone link
# enter your my.innovaphone account, the device must be in one of your projects
# click Invalidate
# click Transfer (this might fail, if NTP or DNS is not configured properly or device certificate is not installed)
# reset if asked for

Steps to invalidate licenses, if your device has no internet connectivity:
# on the web interface of the device go to General->License and follow the my.innovaphone link
# click Invalidate
# click Backup and upload this file on my.innovaphone [[#Upload the invalidation document to return licenses|here]] (Licenses->Devices (select the corresponding device)->Invalidation)
# you'll get a confirmation file after uploading the saved file
# upload this on the device (under Step1)
# reset if asked for

"Your IP800 does not have a device certificate on it." - In this case you need to download a hardware certification,
please contact the innovaphone [mailto:license@innovaphone.com license department].

=====Download confirmation file=====
If you created a new certificate or you invalidated your licenses, you can later download the confirmation file, which you have to upload on the box.

=====Request certificate=====
If you have the needed rights, you can request a new device certificate for your device.

=====Upload the invalidation document to return licenses=====
Licenses->Devices (select the corresponding device)->Invalidation:

Upload the invalidation document, which you got from the website of the device to return the licenses of this device.

After uploading you'll get a confirmation file, which you have to upload on your device.

====Remove====
You can always remove devices from a project. If they have licenses, these won't be deleted, so you might add the device to another project again.

===History===
[[Image:history.jpg|center|thumb|200px|history.jpg/|history.jpg/]]
You can view your history for several contexts:
* Company: history of all actions in your company
* User: history of all actions of the selected user
* Device: history of all actions for the selected device

Each context applies to the currently selected project.
If you deselect the current project, you will see the history over all projects.

You can select to view the history of the last day, week, month, year or from always. Collecting data might take a while...

===Company===
Manage users SSA expiry email flag, import other companies or add your companies innovaphone ID.

====Users====

You can just edit the SSA expiry email flag here. The other user settings moved to the [[#Authorized Persons| Authorized persons tab]].

====Join (admin only)====
As admin you can also join another company into your company by entering an admin account of this company. This might be usefull if one user of your company has accidentally created an own company. 
Everything like projects, users, devices, balance, activations etc. will be imported! 
You also have to enter the company id of the company, which is to be imported. You can find this company under Licenses->Company and the company tab.

This is not available for non company admin users.

The joined company will be deleted afterwards!

====Company====

You can check the '''Device SSA''' checkbox, if you want to receive SSA expiry reminder mails for each device independent of the projects SSA end date.
These mails will be send weekly seven weeks before the SSA for a license a the device expires.
 
 
You can also enter additional email addresses, which should receive SSA emails.
 
You can define a global '''end user expiry mail text''' here, which will be sent to end users, if end users are configured in a [[#SSA Expiry Mail| project]]. This text can be overridden by a text in a project under [[#SSA Expiry Mail| SSA Expiry Mail]].

==RMA==
Here you can see all your RMA devices, which arrived innovaphone already. The licenses of this macadresses are moveable.
[[Image:rma.jpg|center|thumb|200px|rma.jpg/|rma.jpg/]]
 
If you want to request RMA for a certain device, go to the device properties and follow the "Request RMA" link.

==Tickets==
===Mantis===
Here you'll get a list of all open cases and [[Understanding the innovaphone trouble ticket status page#Information available| additional info regarding their state]] in our ticket system. This list is composed of all tickets assigned to email addresses of your my.innovaphone users in your company. 
Often used functions:
* You can click on the ticket number ("ID" column) to open an email prepared with the right emailadress and subject to address this case.
* You can click on the ''History'' link to get an overview of the already made communication with our support/presales-team.
* Another important new function is the option to upload larger files to your support/presales tickets using the ''Fileupload'' column.

===Announcements===
You can convert audio files into G.7xx files which you can use as announcements. 
 
;Supported input formats:
* mp3
* wav
* ogg
* flac
* ...

;Generated output formats:
* G.711u
* G.711a
* G.729
* G.723
* G.722

==Image explanation==

===Errors===

====Already In Company====
[[Image:Icon_in_company_inno_01.png|icon_in_company_inno_01.png/|icon_in_company_inno_01.png/]]
* This device already exists in your company and can't be added/imported.
If you want to import this device anyway, you first have to delete your current device from its project.

====Already Imported====
[[Image:Icon_imported_inno_01.png|icon_imported_inno_01.png/|icon_imported_inno_01.png/]]
* This device has been already imported.
You can't import it again.

====Not Found====
[[Image:Icon_not_found_inno_01.png|icon_not_found_inno_01.png/|icon_not_found_inno_01.png/]]
* This device was not found in the my innovaphone database.
This should never happen, but if, contact the administrator.

====IPVA MAC exists====
[[Image:Icon_ip_va_exists_inno_01.png|icon_ip_va_exists_inno_01.png/|icon_ip_va_exists_inno_01.png/]]
* An IPVA MAC address must be unique and can be assigned to just one company. You tried to add an already existing IPVA MAC.
Please assign a new one to your IPVA. For further details, see [[Reference13r2:Concept_Innovaphone_Virtual_Appliance#License_Configuration]].

my.innovaphone supports the following MAC address ranges:
* 00-50-56-...
* 00-15-5d-...
* 00-03-ff-...
* 00-0d-3a-...
* 00-12-5a-...
* 00-17-fa-...
* 00-50-f2-...
* 00-1d-d8-...
* 00-05-69-...
* 00-1c-14-...
* 00-0c-29-...
* 00-1d-db-...
* 5a-ad-1d-...
* 48-e9-ca-...
* 02-01-04-...
* bc-24-...
* e2-... ''this is an autogenerated MAC address of innovaphone cloud containers''

===Warnings===

====Several Companies====
[[Image:Icon_several_companies_inno_01.png|icon_several_companies_inno_01.png/|icon_several_companies_inno_01.png/]]
* This device is already in another company.
This means, that either you do not have the physical device or it once belonged another company.
You can still import/add this device and you will have access to all of its current licenses.

====Several Users====
[[Image:Icon several users inno 01.png|icon_several_users_inno_01.png/|icon_several_users_inno_01.png/]]
* This device has licenses from several users of the old license manager.
This means, that you are not neccessarily the user, who physically owns this device. If you do not own it, do not import it.

===Misc===
====No downgrade====
[[Image:no_downgrade.png|no_downgrade.png/|no_downgrade.png/]]
* Licenses, which have been downloaded for V5/V6/V7, were returned from this device, so no downgrade to these versions is allowed any more.



==Release dates==
V5: January 1st 2003 
V6: November 2nd 2006 
V7: November 14th 2008 
V8: December 7th 2009 
V9: April 26th 2011 
V10: July 8th 2013 
V11: February 9th 2015 
V12: July 11th 2016 
V13: May 13th 2019 
V14: December 20th 2023 
V15: March 25th 2025 
V16: April 28 2026 



==External interface==

There is an external interface, which you can use to control some functionality without a login to the my.innovaphone web site. 
You can use the interface with an '''HTTP GET''' request to the following URL: 
 
'''<code>https://my.innovaphone.com/interface.php</code>'''

Configure a trust value and a URL (can be a dummy URL if not used otherwise) unter Licenses -> Project -> Properties and tick "Configure Update-URL"

===General parameters for all commands===
:;cmd: the wished command
:;email: the email address of a user who is registered in my.innovaphone
:;project_id: the project ID of the project where the user has access to (you can find the project ID under [[#Properties| Licenses->Projects->Properties]])
:;hash: an SHA256 hash value which is computed over all GET parameters but the hash parameter itself plus the '''trust''' value of the project (see [[#Properties|Reference:My_Innovaphone#Properties]])
:;hash: the values of the GET parameters have to be URL encoded before calculation of the hash

;Example: URL <code>https://my.innovaphone.com/interface.php?cmd=addDevice&email=user@example.com&project_id=123456&serial=00-90-33-01-02-03&hash=b62f7948d6383cc365592ed289b6173cd35229cadc347847b953f78c8880d5b9</code>
:;project trust value: 1234567890abcdef
:;the data of the SHA256 hash: ?cmd=addDevice&email=user%40example.com&project_id=123456&serial=00-90-33-01-02-03&trust=1234567890abcdef
:;example PHP function call to generate the hash: hash("sha256", "?cmd=addDevice&email=user%40example.com&project_id=123456&serial=00-90-33-01-02-03&trust=1234567890abcdef");
:;with the current values, the function should return: b62f7948d6383cc365592ed289b6173cd35229cadc347847b953f78c8880d5b9

===Add a device to a project===
;HTTP GET parameters:
:;general parameters
:;cmd: '''addDevice'''
:;serial: the serial number of the device, e.g. 00-90-33-01-02-03
:;[device_desc]: optional, a description for the new device

;Return value: a JSON object is returned
:;success: boolean, either '''true''' or '''false'''
:;error: string, a string with an error. Just existent if success is false
:;example success: <syntaxhighlight lang="javascript">{ "success":true }</syntaxhighlight>
:;example error: <syntaxhighlight lang="javascript">{ "success":false, "error":"the project with ID 123456 doesn't exist" }</syntaxhighlight>

===Remove a device from a project===
;HTTP GET parameters:
:;general parameters
:;cmd: '''delDevice'''
:;serial: the serial number of the device, e.g. 00-90-33-01-02-03

;Return value: a JSON object is returned
:;success: boolean, either '''true''' or '''false'''
:;error: string, a string with an error. Just existent if success is false
:;example success: <syntaxhighlight lang="javascript">{ "success":true }</syntaxhighlight>
:;example error: <syntaxhighlight lang="javascript">{ "success":false, "error":"the project with ID 123456 doesn't exist" }</syntaxhighlight>

===Get the warranty of a device===
;HTTP GET parameters:
:;general parameters
:;cmd: '''getWarranty'''
:;serial: the serial number of the device, e.g. 00-90-33-01-02-03

;Return value: a JSON object is returned
:;success: boolean, either '''true''' or '''false'''
:;error: string, a string with an error. Just existent if success is false
:;warranty: a unix timestamp in seconds since 1970 (timezone Europe/Berlin), e.g. '''1448492400'''
:;warrantyStr: a string like '''"2015-11-26 00:00:00"'''

===Create a new project===
;HTTP GET parameters:
:;general parameters: you must use the project_id and trust value of an already existing project!
:;cmd: '''createProject'''
:;project_name: the name of the new project
:;[project_desc]: optional, a description for the new project
:;[update_url]: optional, an update URL for the project (do not forget to URL encode the value inside your HTTP GET request!)
:;[ssa_due_date]: optional, a unix timestamp in seconds since 1970 (timezone Europe/Berlin), e.g. '''1448492400'''

;Return value: a JSON object is returned
:;success: boolean, either '''true''' or '''false'''
:;error: string, a string with an error. Just existent if success is false
:;projectId: the project id of the created project

The newly created project is created with the same trust value which was used for the creation request. This allows you to directly use the API with the new project.

==Known Issues==
===Smaller issues===
* Devices where imported into a project with SSA. If this happened to you, please move the corresponding devices into a project '''without''' SSA and back into the project '''with''' SSA to extend/add SSA for the licenses until the SSA end date.
* IE7 moves a list under the menu, when a list becomes to wide
===Licenses don't work on a device, where an invalidation has been done===
A possible reason here is, that the invalidation process hasn't been completed.
To resolve this issue, follow these steps:

* Download the Confirmation File (Certificate) from http://my.innovaphone.com under [[#Invalidation|Invalidation]] after selecting the project and the device
* Open [[Reference9:General/License/my.innovaphone|General->License->my.innovaphone.com]] on your device
* Click on "Invalidate" (no my.innovaphone credentials needed)
* Upload the previously downloaded confirmation file newcert-00-90-33-xx-xx-xx.xml as "Confirmation file"
* Reset the box
* Reupload the licenses

===Internet Explorer doesn't work===
Yes, that's correct. Please use an up to date version of Chrome, Firefox or Edge!

===Licenses don't work on an IPVA===
Enable the trace flag on the LICENSE module, reboot and check the log:
* !config add LICENSE /trace
* !config write
* !reset
* log.txt

If the log contains '''Invalid sequence number''', the VM disk with the certificate was somehow corrupted. To recover:

* download the configuration of the IPVA
* create a new IPVA from scratch inside your hypervisor
* stop the old IPVA
* restore the same MAC address of the old IPVA on the new IPVA
* start the new IPVA and restore the configuration
* generate a new device certificate under General -> License -> my.innovaphone

Especificações IP222

2026-07-29T08:30:34Z

Vsc:

{{datasheet_header|innovaphone IP222/IP222A|Telefone IP com display colorido, teclas de função e 3 x UBS}}
<div class="datasheets-mehrspaltig">
[[Image:IP222.png]]
===Tipos===
* IP222: Orchid-HW-Plataforma
* IP222A: IMX6-HW-Plataforma (substitui o IP222, Start-MAC 00-90-33-5A-6D-C5)
===Firmware===
* IP222: Telefone compatível com a versão 9 e superior
* IP222A: Telefone compatível com a versão 13r3sr2 e superior
===Características===
Display colorido, 320 x 240 pixels (3,5 polegadas)

Teclado do telefone

2 x 6 teclas de função dinâmica (uso múltiplo de 16 teclas dinamicamente atribuíveis)

Teclas de navegação

Dimensões: 21,5 x 15 x 3 cm (base)

Peso: aprox. 835 g com pé standard

===Interfaces===
1 x Gigabit-Ethernet: 1000-BASE-T (auto negotiation), RJ-45 (modular Jack 8P8C) com “Power over Ethernet” conforme IEEE 802.3af e Eficiência energética segundo IEEE 802.3az

1 x Gigabit-Ethernet: 1000-BASE-T (auto negotiation), RJ-45 (modular Jack 8P8C) para conexão de PC

Entrada para alimentação externa

4 x USB-A 2.0 para conexão de headfone / auscultadores e módulo de expansão

===Hardware===
Alimentação: PSU externa 12 V, 6 W (opcional) ou “Power over Ethernet” conforme IEEE 802.3af, Class 2

Memória interna
* IP222: 16 MB DDR3, 8 MB Flash
* IP222A: 128 MB DDR3, 16 MB Flash

{{Template:Leistungsmerkmale PT - Hardware Telefone}}

{{Template:Leistungsmerkmale PT - Sprach Coder|G.722, IP222A adicional: Opus-NB, Opus-WB, G.729 (a partir de 15r1sr16/16r1sr4)}}

{{Endgeräte_Firmware_Technische_Daten_PT}}
===Características especiais===
* IP222: Função Viva Voz (função mãos livres, sem escuta amplificada)
* IP222A: Mãos livres, escuta aberta

{{Template:Leistungsmerkmale PT - Lizenzen Telefone}}

{{Template:CE-Decl_Phones|Declaração de conformidade|ver ficha de informação em separado}}
===Código do produto: 01-00222-001===
</div>
{{Template:Datasheet_footer|PT}}
[[Category:Fichas técnicas Phones PT|{{PAGENAME}}]]

Especificações IP160

2026-07-29T08:30:23Z

Vsc:

{{datasheet_header|innovaphone IP160|Telefone IP à prova choques e de intempéries}}
<div class="datasheets-mehrspaltig">
[[Image:IP160.png]]
===Firmware===
Telefone compatível com a versão 13r2sr13 e superior

===Características===
Tela colorida OLED, 128 x 64 pixels

Teclado do telefone com luz de fundo vermelha

Grau de proteção: IP 65 (IEC60529)

Volume aprox. 95 dB(A) a uma distância de 1 m

Montagem na parede e na mesa (placa de montagem reversível)

Dimensões: 29,3 x 19,1 x 12,8 cm

Peso: aprox. 2,3 kg
===Interfaces===
1 x Gigabit-Ethernet: 1000-BASE-T (auto negotiation), RJ-45 (modular Jack 8P8C) com “Power over Ethernet” conforme IEEE 802.3af e Eficiência energética segundo IEEE 802.3az

1 x Gigabit-Ethernet: 1000-BASE-T (auto negotiation), RJ-45 (modular Jack 8P8C) para conexão de PC

Conexão para headset analógico

Relé integrado (baixa potência)

Opção para Relayboard com Relayoutputs e Controlinput

===Hardware===
Fonte de alimentação: Power over Ethernet de acordo com 802.3af, Classe 0 ou externa de 24V através da utilização da régua de terminais interna

Temperatura de operação: -40°C a +60°C

{{Template:Leistungsmerkmale PT - Sprach Coder|G.722, Opus-NB, Opus-WB, G.729 (a partir de 15r1sr16/16r1sr4)}}

{{Endgeräte_Firmware_Technische_Daten_PT}}

===Características especiais===
Escuta aberta (sem viva-voz))

{{Template:Leistungsmerkmale PT - Lizenzen Telefone}}

{{Template:CE-Decl_Phones|Declaração de conformidade|ver ficha de informação em separado}}
===Código do produto: 01-00160-001===
</div>
{{Template:Datasheet_footer|PT}}
[[Category:Fichas técnicas Phones PT|{{PAGENAME}}]]

Especificações IP112

2026-07-29T08:30:15Z

Vsc:

{{datasheet_header|innovaphone IP112/IP112A/IP112-secure|Telefone multifuncional com grande display colorido, conexão de headset & gigabit}}
<div class="datasheets-mehrspaltig">
[[Image:IP11x.png]]
===Tipos===
* IP112: Interruptor do gancho mecânico
* IP112A: Interruptor do gancho sensorial (substitui o IP112, Start-MAC: 00-90-33-51-4a-7f)
* IP112-secure: de acordo com a Directriz Técnica BSI 03305 dispositivo zonado baseado em IP112A
===Firmware===
* IP112: Telefone compatível com a versão 11 e superior
* IP112A: Telefone compatível com a versão 11r2sr49, 12r1sr35, 12r2sr33 e 13r1sr8 e superior; de HW1601 min. 13r3sr5
* IP112-secure: Telefone compatível com a versão 13r2sr19 e superior

===Características===
Display colorido, 320 x 240 pixels (3,5 polegadas)

Teclado do telefone

2 x 6 teclas de função (16 teclas de função e 32 teclas de parceiro podem ser atribuídas dinamicamente através de múltiplas utilizações)

9 teclas especiais

Dimensões: 21 x 15,5 x 3,5 cm (base), Montagem na parede e na mesa (placa de montagem reversível)

Peso: aprox. 800 g

===Interfaces===
1 x Gigabit-Ethernet: 1000-BASE-T (auto negotiation), RJ-45 (modular Jack 8P8C) com “Power over Ethernet” conforme IEEE 802.3af e Eficiência energética segundo IEEE 802.3az

1 x Gigabit-Ethernet: 1000-BASE-T (auto negotiation), RJ-45 (modular Jack 8P8C) para conexão de PC

Entrada para alimentação externa

1 x USB-A 2.0 para conexão de headfone / auscultadores

===Hardware===
Alimentação: PSU externa 12 V, 6 W (opcional) ou “Power over Ethernet” conforme IEEE 802.3af, Class 2

Memória interna: 128 MB DDR3, 16 MB Flash

{{Template:Leistungsmerkmale PT - Hardware Telefone}}

{{Template:Leistungsmerkmale PT - Sprach Coder|G.722, Opus-NB, Opus-WB, G.729 (a partir de 15r1sr16/16r1sr4)}}

{{Endgeräte_Firmware_Technische_Daten_PT}}
===Características especiais===
Mãos livres, escuta aberta

{{Template:Leistungsmerkmale PT - Lizenzen Telefone}}

{{Template:CE-Decl_Phones|Declaração de conformidade|ver ficha de informação em separado}}
===Código do produto IP112A: 01-00112-001===
===Código do produto IP112-secure: 01-00112-005===
</div>
{{Template:Datasheet_footer|PT}}
[[Category:Fichas técnicas Phones PT|{{PAGENAME}}]]

Especificações IP111

2026-07-29T08:30:07Z

Vsc:

{{datasheet_header|innovaphone IP111/IP111A/IP111-maritime|Telefone multifuncional com grande display colorido & teclas de função}}
<div class="datasheets-mehrspaltig">
[[Image:IP11x.png]]
===Tipos===
* IP111: Interruptor do gancho mecânico
* IP111A: Interruptor do gancho sensorial (substitui o IP111, Start-MAC: 00-90-33-4f-42-af)
* IP111-maritime: DNV-GL certificado
===Firmware===
* IP111: Telefone compatível com a versão 11 e superior
* IP111A: Telefone compatível com a versão 11r2sr49, 12r1sr35, 12r2sr33 e 13r1sr8 e superior; de HW1501 min. 13r3sr5

===Características===
Display colorido, 320 x 240 pixels (3,5 polegadas)

Teclado do telefone

2 x 6 teclas de função (16 teclas de função e 32 teclas de parceiro podem ser atribuídas dinamicamente através de múltiplas utilizações)

9 teclas especiais

Dimensões: 21 x 15,5 x 3,5 cm (base), Montagem na parede e na mesa (placa de montagem reversível)

Peso: aprox. 630 g

===Interfaces===
1 x Ethernet: 10/100-BASE-TX (auto negotiation), RJ-45 (modular Jack 8P8C) com “Power over Ethernet” conforme IEEE 802.3af e Eficiência energética segundo IEEE 802.3az

1 x Ethernet: 10/100-BASE-TX (auto negotiation), RJ-45 (modular Jack 8P8C) para conexão de PC

Entrada para alimentação externa

===Hardware===
Alimentação: PSU externa 12 V, 6 W (opcional) ou “Power over Ethernet” conforme IEEE 802.3af, Class 1

Memória interna: 128 MB DDR3, 16 MB Flash

{{Template:Leistungsmerkmale PT - Hardware Telefone}}

{{Template:Leistungsmerkmale PT - Sprach Coder|G.722, Opus-NB, Opus-WB, G.729 (a partir de 15r1sr16/16r1sr4)}}

{{Endgeräte_Firmware_Technische_Daten_PT}}
===Características especiais===
Mãos livres, escuta aberta

{{Template:Leistungsmerkmale PT - Lizenzen Telefone}}

{{Template:CE-Decl_Phones|Declaração de conformidade|ver ficha de informação em separado}}
===Código do produto: 01-00111-001===
===Código do produto IP111-maritime: 01-00111-003===
</div>
{{Template:Datasheet_footer|PT}}
[[Category:Fichas técnicas Phones PT|{{PAGENAME}}]]

Specyfikacja IP1203

2026-07-29T08:28:48Z

Vsc:

{{datasheet_header|innovaphone IP1202/4s, IP1203x|Stacja bazowa IP-DECT z 8 lub 4 kanałami}}
<div class="datasheets-mehrspaltig">
[[Image:ip1203.png]]
===Warianty===
* IP1202/4s: jednokomórkowa, 4-kanałowa stacja bazowa bez możliwości rozbudowy o dodatkową stację bazową
* IP1203/4: wielokomórkowa 4-kanałowa stacja bazowa
* IP1203: wielokomórkowa 8-kanałowa stacja bazowa
* IP1203e: wielokomórkowa 8-kanałowa stacja bazowa z możliwością podłączenia anteny zewnętrznej

===Oprogramowanie===
* IP1202/4s: Urządzenie może być używane od wersji firmware 9
* IP1203x: Urządzenie może być używane od wersji firmware 13r1

===Obudowa===
Wymiary: 170 x 170 x 38 mm

Białe tworzywo sztuczne

Waga: 400 g
===Interfejsy===
Ethernet: RJ 45, 10/100-BASE-TX (auto negocjacja), Power over Ethernet (802.3af, Class 2)

Tylko brama IP1203e: 2 x Łącze MCX dla anteny zewnętrznej

Odpowiednie anteny można znaleźć na stronie internetowej pod innovaphone Serwis / Pliki do pobrania / Dokumenty zewnętrzne.

===DECT===
Kompatibylne z GAP/ CAP

Zakres częstotliwości: 1880-1900 MHz

Jednoczesne połączenia głosowe:
* IP1202/4s, IP1203/4: obsługa do 4 połączeń głosowych jednocześnie
* IP1203, IP1203e: obsługa do 8 połączeń głosowych jednocześnie
Możliwa rejestracja do 1000 urządzeń do jednej “komórki”

System wielokomórkowy (nie IP1202/4s)

Roaming (nie IP1202/4s)

Handover (tylko ze słuchawkami CAP)

Synchronizacja "On Air"

Moc wyjściowa z antenami wewnętrznymi(e.r.p.): 23 dBm - 28 dBm (EU), 17 dBm - 21,6 dBm (US)

===Hardware===
Power over Ethernet lub zasilacz sieciowy 21 - 56 V DC, max. 5 W

===Warunki środowiska pracy===
Zalecana temperatura otoczenia: -10 °C do +55 °C,

Temperatura przechowywania: -25 °C do +55 °C

Wilgotność: 15%-90% (bez kondensacji)

===Administracja===
Poprzez przeglądarkę

Chronione hasłem

Administracja i aktualizacja oprogramowania

===Protokoły VoIP===
H.323 wersja 5, w tym opatentowane rozszerzenia

H.323 przez UDP, TCP, TLS (H.460.17)

SIP wersja 2 zgodnie z RFC 3261

SIP over UDP, TCP, TLS

RTP, SRTP (SDES, DTLS), RTCP, ICE

===Kodeki głosowe===
G.711 A-law / µ-law, G722.2 (AMR-WB), G.729 (od 15r1sr16/16r1sr4)

Voice Activity Detection, Comfort Noise Generation

Dynamic Jitter Buffering

Kompensacja echa: G.168

===Funkcje sieciowe===
STUN, TURN nad TCP/UDP

RSTP, EAP-TLS/EAP-MD5 zgodnie z IEEE 802.1x

VLAN-ID zgodnie z IEEE 802.1q

DHCP i LLDP/MED Support

NTP-Support

===Dodatkowo===
Wyświetlanie statusu LED

Przeznaczone do użytku z aparatami innovaphone IP61, IP63, IP64, IP65 i Ascom d83

Poprzez wybór sekwencji kodowych mogą być używane również funkcje specjalne innovaphone PBX, np. funkcje grupowe takie jak przejęcie rozmowy, parkowanie i dynamiczne logowanie do określonej grupy.

Dostęp do centralnej książki telefonicznej centrali i innych zewnętrznych baz danych poprzez LDAP.

Obsługa konferencji 3-stronnej z dodatkowym wykorzystaniem bramy innovaphone z kanałami konferencyjnymi

Możliwość kombinacji IP1203 i IP1202 (nie IP1202/4s)

{{Template:CE-Decl_Gateways|Deklaracje zgodności|patrz oddzielny arkusz informacyjny}}
===Nr katalogowy IP1203: 50-01203-001===
===Nr katalogowy IP1203/4: 50-01203-002===
===Nr katalogowy IP1203e: 50-01203-004===
===Nr Podwójna antena kierunkowa dla IP1203e: 50-01202-004===
===Nr katalogowy Pojedyncza antena kierunkowa dla IP1203e: 50-01202-005===
===Nr katalogowy Antena dookolna dla IP1203e: 50-01202-006===
</div>
{{Template:Datasheet_footer|PL}}
[[Category:Specyfikacja techniczna Gateways PL|{{PAGENAME}}]]

Specyfikacja IP222

2026-07-29T08:28:35Z

Vsc:

{{datasheet_header|innovaphone IP222/IP222A|Nowoczesny telefon: kolorowy ekran, 3 x USB, przyciski funkcyjne, biały lub czarny}}
<div class="datasheets-mehrspaltig">
[[Image:IP222.png]]
===Wersje===
* IP222: Orchid-HW-Platforma
* IP222A: IMX6-HW-Platforma (zastępuje model IP222, Start-MAC 00-90-33-5A-6D-C5)
===Oprogramowanie===
* IP222: Wersja oprogramowania 9 lub nowsza
* IP222A: Wersja oprogramowania 13r3sr2 lub nowsza
===Obudowa===
Kolorowy wyświetlacz, 320 x 240 Pikseli (3,5 cala)

Klawiatura telefonu

2 x 6 klawisze funkcyjne (16 klawiszy dynamicznie przypisanych, wielokrotnego użytku)

4 kierunkowy klawisz nawigacyjny

Wymiary: 21,5 x 15 x 3 cm (Podstawa)

Waga: około 835 g ze stopą standardową
===Interfejsy===
1 x Gigabit-Ethernet: 1000-BASE-T (auto negocjacja), RJ-45 (modular Jack 8P8C) z “Power over Ethernet” nzgodnie z IEEE 802.3af i “Energy Efficient Ethernet” zgodnie z IEEE 802.3az

1 x Gigabit-Ethernet: 1000-BASE-T (auto negocjacja), RJ-45 (modular Jack 8P8C) do podłączenia komputera

Gniazdo zasilacza

4 x USB-A 2.0 do podłączenia zestawu słuchwakowego lub modułu rozszerzającego

===Hardware===
Zasilanie: zasilacz zewnętrzny: 12 V, 6 W lub Power over Ethernet zgodnie z IEEE 802.3af, Class 2
* IP222: 16 MB SDRAM, 8 MB Flash
* IP222A: 128 MB SDRAM, 16 MB Flash
{{Template:Leistungsmerkmale PL - Hardware Telefone}}
{{Template:Leistungsmerkmale PL - Sprach Coder|G.722, IP222A dodatkowe: Opus-NB, Opus-WB, G.729 (od 15r1sr16/16r1sr4)}}
{{Endgeräte_Firmware_Technische_Daten_PL}}
===Funkcje dodatkowe===
* IP222: tryb głośnomówiący (bez otwartego słuchania)
* IP222A: słuchanie w trybie głośnomówiącym i otwartym
{{Template:Leistungsmerkmale PL - Lizenzen Telefone}}
{{Template:CE-Decl_Phones|Deklaracje zgodności|patrz oddzielny arkusz informacyjny}}
===Nr katalogowy: 01-00222-001===
</div>
{{Template:Datasheet_footer|PL}}
[[Category:Specyfikacja techniczna Phones PL|{{PAGENAME}}]]

Specyfikacja IP174

2026-07-29T08:28:24Z

Vsc:

{{datasheet_header|innovaphone IP174|Stacja interkomowa}}
<div class="datasheets-mehrspaltig">
[[Image:IP174-x.png]]
===Oprogramowanie===
Urządzenie działa z wersją 16 i nowszą
===Obudowa===
* Montaż naścienny
* Głośnik przedni – 80 mm, 4 omy, tworzywo sztuczne
* Obudowa IP66 do montażu na zewnątrz, pylo- i wodoszczelna, odporna na mgłę solną
* Klawisze foliowe
* IP174-1: jeden klawisz szybkiego wybierania
* IP174-4: 4 klawisze szybkiego wybierania
* IP174-15: 12-klawiszowa klawiatura telefoniczna
* Każdy model: 3 klawisze trybu połączeń (głośnomówiący, bezpośredni/priorytetowy, PTT), 2 klawisze głośności
* Wskaźnik połączenia
* Wymiary (szer. x gł. x wys.): 130 x 70 x 303 mm
* Waga: ok. 1500 gramów
===Interfejsy===
* 10/100-BASE-TX (auto negocjacja), RJ-45 (modular Jack 8P8C)
* Zewnętrzny zasilacz 24 V (wejście)
* Wyjście 24 V DC (500 mA)
* Przekaźnik (NO/NC)
* Słuchawka (6-żyłowa)
* Zestaw słuchawkowy (6-żyłowy) z obsługą PTT
* Głośnik zewnętrzny
* Tylny port USB – wyłącznie do użytku wewnętrznego
===Hardware===
* Zasilanie: „Power over Ethernet+” zgodnie z IEEE 802.3at, Class 4
* 128 MB pamięci RAM, 16 MB pamięci Flash
* Temperatura pracy: od -25 °C do +70 °C
* Wilgotność: od 10% do 90% (bez kondensacji)
* Temperatura przechowywania: od -10 °C do +70 °C
{{Template:Leistungsmerkmale PL - Sprach Coder|G.722, Opus-NB, Opus-WB, G.729 (od 15r1sr16/16r1sr4)}}
{{Template:Leistungsmerkmale PL - Voip Protokolle13}}
{{Template:Leistungsmerkmale PL - Netzwerk13}}

Tunelowanie PPTP do 4 tuneli jednocześnie, szyfrowanie za pomocą MPPE
{{Template:Leistungsmerkmale PL - Administration13}}
===Funkcje dodatkowe===
* Przycisk głośnomówiący – połączenia głośnomówiące w trybie pełnego dupleksu
* Przycisk bezpośredniego połączenia – pełnodupleksowe dołączanie do rozmowy w stanie bezczynności lub zajętości (funkcję można wyłączyć)
* Przycisk PTT – funkcja Talkback i klasyczne użycie PTT (funkcja wyciszenia mikrofonu)
* Komunikaty strefowe – nieograniczona liczba stref
{{Template:Leistungsmerkmale PL - Lizenzen Telefone}}
{{Template:CE-Decl_Phones|Deklaracje zgodności|patrz oddzielny arkusz informacyjny}}
===Numer katalogowy IP174-1: 01-01741-001===
===Numer katalogowy IP174-4: 01-01744-001===
===Numer katalogowy IP174-15: 01-17415-001===
</div>
{{Template:Datasheet_footer|PL}}
[[Category:Specyfikacja techniczna Phones PL|{{PAGENAME}}]]

Specyfikacja IP172

2026-07-29T08:28:17Z

Vsc:

{{datasheet_header|innovaphone IP172|Przemysłowa stacja interkomowa}}
<div class="datasheets-mehrspaltig">
[[Image:IP172.png]]
===Oprogramowanie===
Urządzenie działa z wersją 16 i nowszą
===Obudowa===
* Montaż naścienny
* Głośnik tylny – 46 mm, 50 Ohm, tworzywo sztuczne, do sygnalizacji dzwonienia
* Obudowa IP66 do zastosowań w warunkach zewnętrznych, pylo- i wodoszczelna, odporna na mgłę solną
* Klawisze foliowe
* Klawiatura telefoniczna z 12 klawiszami
* 3 klawisze trybu połączeń (głośnomówiący, bezpośredni/priorytetowy, PTT), 2 klawisze głośności
* Wskaźnik połączenia
* Wymiary (szer. x gł. x wys.): 130 x 70 x 303 mm
* Waga: ok. 1500 gramów
===Interfejsy===
* 10/100-BASE-TX (auto negocjacja), RJ-45 (modular Jack 8P8C)
* Zewnętrzny zasilacz 24 V (wejście)
* Wyjście 24 V DC (500 mA)
* Przekaźnik (NO/NC)
* Słuchawka (6-żyłowa)
* Zestaw słuchawkowy (6-żyłowy) z obsługą PTT
* Głośnik zewnętrzny
* Tylny port USB – wyłącznie do użytku wewnętrznego
===Hardware===
* Zasilanie: „Power over Ethernet+” zgodnie z IEEE 802.3at, Class 4
* 128 MB pamięci RAM, 16 MB pamięci Flash
* Temperatura pracy: od -25 °C do +70 °C
* Wilgotność: od 10% do 90% (bez kondensacji)
* Temperatura przechowywania: od -10 °C do +70 °C
{{Template:Leistungsmerkmale PL - Sprach Coder|G.722, Opus-NB, Opus-WB, G.729 (od 15r1sr16/16r1sr4)}}
{{Template:Leistungsmerkmale PL - Voip Protokolle13}}
{{Template:Leistungsmerkmale PL - Netzwerk13}}

Tunelowanie PPTP do 4 tuneli jednocześnie, szyfrowanie za pomocą MPPE
{{Template:Leistungsmerkmale PL - Administration13}}
===Funkcje dodatkowe===
* Przycisk głośnomówiący – połączenia głośnomówiące w trybie pełnego dupleksu
* Przycisk bezpośredniego połączenia – pełnodupleksowe dołączanie do rozmowy w stanie bezczynności lub zajętości (funkcję można wyłączyć)
* Przycisk PTT – funkcja Talkback i klasyczne użycie PTT (funkcja wyciszenia mikrofonu)
* Komunikaty strefowe – nieograniczona liczba stref
{{Template:Leistungsmerkmale PL - Lizenzen Telefone}}
{{Template:CE-Decl_Phones|Deklaracje zgodności|patrz oddzielny arkusz informacyjny}}
===Numer katalogowy IP172: 01-00172-001===
</div>
{{Template:Datasheet_footer|PL}}
[[Category:Specyfikacja techniczna Phones PL|{{PAGENAME}}]]

Specyfikacja IP171

2026-07-29T08:28:11Z

Vsc:

{{datasheet_header|innovaphone IP171|Stacja interkomowa do montażu naściennego}}
<div class="datasheets-mehrspaltig">
[[Image:IP171.png]]
===Oprogramowanie===
Urządzenie działa z wersją 16 i nowszą
===Obudowa===
* Montaż naścienny
* Głośnik przedni – 60 mm, 8 Ω, tworzywo sztuczne
* Obudowa IP66 do montażu na zewnątrz, pylo- i wodoszczelna, odporna na mgłę solną
* Wyświetlacz OLED, 128 x 64 pikseli
* Podświetlane silikonowe klawisze funkcyjne (3 x dynamicznie programowalne, 3 x nawigacyjne)
* Podświetlana silikonowa klawiatura telefoniczna
* Podświetlane silikonowe klawisze trybu połączeń (głośnomówiący, bezpośredni/priorytetowy, PTT)
* Wskaźnik połączenia
* Czujnik światła otoczenia
* Wymiary (szer. x gł. x wys.): 132 x 70 x 303 mm
* Waga: ok. 1500 gramów
===Interfejsy===
* 10/100-BASE-TX (auto negocjacja), RJ-45 (modular Jack 8P8C)
* Zewnętrzny zasilacz 24 V (wejście)
* Wyjście 24 V DC (500 mA)
* Przekaźnik (NO/NC)
* Słuchawka (6-żyłowa)
* Zestaw słuchawkowy (6-żyłowy) z obsługą PTT
* Głośnik zewnętrzny
* Tylny port USB – wyłącznie do użytku wewnętrznego
===Hardware===
* Zasilanie: „Power over Ethernet+” zgodnie z IEEE 802.3at, Class 4
* 128 MB pamięci RAM, 16 MB pamięci Flash
* Temperatura pracy: od +5 °C do +55 °C
* Wilgotność: od 10% do 90% (bez kondensacji)
* Temperatura przechowywania: od -10 °C do +70 °C
{{Template:Leistungsmerkmale PL - Sprach Coder|G.722, Opus-NB, Opus-WB, G.729 (od 15r1sr16/16r1sr4)}}
{{Template:Leistungsmerkmale PL - Voip Protokolle13}}
{{Template:Leistungsmerkmale PL - Netzwerk13}}

Tunelowanie PPTP do 4 tuneli jednocześnie, szyfrowanie za pomocą MPPE
{{Template:Leistungsmerkmale PL - Administration13}}
===Funkcje dodatkowe===
* Przycisk głośnomówiący – połączenia głośnomówiące w trybie pełnego dupleksu
* Przycisk bezpośredniego połączenia – pełnodupleksowe dołączanie do rozmowy w stanie bezczynności lub zajętości (funkcję można wyłączyć)
* Przycisk PTT – funkcja Talkback i klasyczne użycie PTT (funkcja wyciszenia mikrofonu)
* Komunikaty strefowe – nieograniczona liczba stref
{{Template:Leistungsmerkmale PL - Lizenzen Telefone}}
{{Template:CE-Decl_Phones|Deklaracje zgodności|patrz oddzielny arkusz informacyjny}}
===Numer katalogowy: 01-00171-001===
</div>
{{Template:Datasheet_footer|PL}}
[[Category:Specyfikacja techniczna Phones PL|{{PAGENAME}}]]

Specyfikacja IP170

2026-07-29T08:28:05Z

Vsc:

{{datasheet_header|innovaphone IP170|Stacja interkomowa do montażu podtynkowego}}
<div class="datasheets-mehrspaltig">
[[Image:IP170.png]]
===Oprogramowanie===
Urządzenie działa z wersją 16 i nowszą
===Obudowa===
* Montaż podtynkowy
* Głośnik przedni – 61 mm, 4 Ω
* Klasa ochrony IP20
* Wyświetlacz OLED, 128 x 64 pikseli
* Podświetlane silikonowe klawisze funkcyjne (3 x dynamicznie programowalne, 3 x nawigacyjne)
* Podświetlana silikonowa klawiatura telefoniczna
* Podświetlane silikonowe klawisze trybu połączeń (głośnomówiący, bezpośredni/priorytetowy, PTT)
* Wskaźnik połączenia
* Czujnik światła otoczenia
* Wymiary (szer. x gł. x wys.): 94 x 31 x 269 mm
* Waga: ok. 650 gramów
===Interfejsy===
* 10/100-BASE-TX (auto negocjacja), RJ-45 (modular Jack 8P8C)
* Zewnętrzny zasilacz 24 V (wejście)
* Wyjście 24 V DC (500 mA)
* Przekaźnik (NO/NC)
* Słuchawka (6-żyłowa)
* Zestaw słuchawkowy (6-żyłowy) z obsługą PTT
* Głośnik zewnętrzny
* Tylny port USB – wyłącznie do użytku wewnętrznego
===Hardware===
* Zasilanie: „Power over Ethernet+” zgodnie z IEEE 802.3at, Class 4
* 128 MB pamięci RAM, 16 MB pamięci Flash
* Temperatura pracy: od +5 °C do +55 °C
* Wilgotność: od 10% do 90% (bez kondensacji)
* Temperatura przechowywania: od -10 °C do +70 °C
{{Template:Leistungsmerkmale PL - Sprach Coder|G.722, Opus-NB, Opus-WB, G.729 (od 15r1sr16/16r1sr4)}}
{{Template:Leistungsmerkmale PL - Voip Protokolle13}}
{{Template:Leistungsmerkmale PL - Netzwerk13}}

Tunelowanie PPTP do 4 tuneli jednocześnie, szyfrowanie za pomocą MPPE
{{Template:Leistungsmerkmale PL - Administration13}}
===Funkcje dodatkowe===
* Przycisk głośnomówiący – połączenia głośnomówiące w trybie pełnego dupleksu
* Przycisk bezpośredniego połączenia – pełnodupleksowe dołączanie do rozmowy w stanie bezczynności lub zajętości (funkcję można wyłączyć)
* Przycisk PTT – funkcja Talkback i klasyczne użycie PTT (funkcja wyciszenia mikrofonu)
* Komunikaty strefowe – nieograniczona liczba stref
{{Template:Leistungsmerkmale PL - Lizenzen Telefone}}
{{Template:CE-Decl_Phones|Deklaracje zgodności|patrz oddzielny arkusz informacyjny}}
===Numer katalogowy: 01-00170-001===
</div>
{{Template:Datasheet_footer|PL}}
[[Category:Specyfikacja techniczna Phones PL|{{PAGENAME}}]]

Specyfikacja IP160

2026-07-29T08:27:58Z

Vsc:

{{datasheet_header|innovaphone IP160|Telefon IP z solidną i odporną na warunki atmosferyczne obudową}}
<div class="datasheets-mehrspaltig">
[[Image:IP160.png]]
===Oprogramowanie===
Wersja oprogramowania 13r2sr13 lub nowsza
===Obudowa===
Kolorowy wyświetlacz OLED, 128 x 64 pikseli

Klawiatura telefoniczna z czerwonym podświetleniem

Stopień ochrony: IP 65 (IEC60529)

Poziom głośności dzwonka ok 95 dB(A) w odległości 1 m

Montaż ścienny i stołowy (odwracalna płyta montażowa)

Wymiary: 29,3 x 19,1 x 12,8 cm

Waga: ok. 2300 g

===Interfejsy===
1 x Gigabit-Ethernet: 1000-BASE-T (auto negocjacja), RJ-45 (modular Jack 8P8C) z “Power over Ethernet” nzgodnie z IEEE 802.3af i “Energy Efficient Ethernet” zgodnie z IEEE 802.3az

1 x Gigabit-Ethernet: 1000-BASE-T (auto negocjacja), RJ-45 (modular Jack 8P8C) do podłączenia komputera

Gniazdo do podłączenia analogowego zestawu słuchawkowego

Wbudowany przekaźnik (o małej mocy)

Opcja dla karty przekaźnikowej z wyjściami przekaźnikowymi i wejściem sterującym

===Hardware===
Zasilanie: Power over Ethernet zgodnie z 802.3af, Class 0 lub zewnętrzne zasilanie 24 V za pomocą wewnętrznej listwy zaciskowej

Zakres temperatury użytkowania: -40°C do +60°C

{{Template:Leistungsmerkmale PL - Sprach Coder|G.722, Opus-NB, Opus-WB, G.729 (od 15r1sr16/16r1sr4)}}
{{Endgeräte_Firmware_Technische_Daten_PL}}

===Funkcje dodatkowe===
* Głośnik (bez zestawu głośnomówiącego)
{{Template:Leistungsmerkmale PL - Lizenzen Telefone}}
{{Template:CE-Decl_Phones|Deklaracje zgodności|patrz oddzielny arkusz informacyjny}}
===Nr katalogowy: 01-00160-001===
</div>
{{Template:Datasheet_footer|PL}}
[[Category:Specyfikacja techniczna Phones PL|{{PAGENAME}}]]

Specyfikacja IP112

2026-07-29T08:27:51Z

Vsc:

{{datasheet_header|innovaphone IP112/IP112A/IP112-secure|Wielofunkcyjny telefon: duży kolorowy wyświetlacz, port do headset & gigabit}}
<div class="datasheets-mehrspaltig">
[[Image:IP11x.png]]
===Wersje===
* IP112: Przełącznik mechaniczny
* IP112A: Przełącznik sensoryczny/bezdotykowy (zastępuje model IP112, Start-MAC: 00-90-33-51-4a-7f)
* IP112-secure: zgodnie z wytycznymi technicznymi BSI 03305 urządzenie strefowe oparte na IP112A
===Oprogramowanie===
* IP112: Wersja oprogramowania 11 lub nowsza
* IP112A: Wersja oprogramowania 11r2sr49, 12r1sr35, 12r2sr33, 13r1sr8 lub nowsza; od HW1601 min. 13r3sr5
* IP112-secure: Wersja oprogramowania 13r2sr19 lub nowsza

===Obudowa===
Kolorowy wyświetlacz, 320 x 240 Pixel (3,5 cala)

Klawiatura telefonu

2 x 6 przyciski funkcyjne (16 przycisków funkcyjnych i 32 przyciski partnerskie dynamicznie przypisywane z możliwością wielokrotnego użycia)

9 specjalnych przyciskow

wymiary: 21 x 15,5 x 3,5 cm (Podstawa), Montaż ścienny i stołowy (odwracalna płyta montażowa)

Waga: około 800 g

===Interfejsy===
1 x Gigabit-Ethernet: 1000-BASE-T (auto negocjacja), RJ-45 (modular Jack 8P8C) z “Power over Ethernet” nzgodnie z IEEE 802.3af i “Energy Efficient Ethernet” zgodnie z IEEE 802.3az

1 x Gigabit-Ethernet: 1000-BASE-T (auto negocjacja), RJ-45 (modular Jack 8P8C) do podłączenia komputera

Gniazdo zasilacza

1 x USB-A 2.0 do podłączenia zestawu słuchawkowego

===Hardware===
Zasilanie: zasilacz zewnętrzny: 12 V, 6 W lub Power over Ethernet zgodnie z IEEE 802.3af, Class 2

128 MB SDRAM, 16 MB Flash

{{Template:Leistungsmerkmale PL - Hardware Telefone}}
{{Template:Leistungsmerkmale PL - Sprach Coder|G.722, Opus-NB, Opus-WB, G.729 (od 15r1sr16/16r1sr4)}}
{{Endgeräte_Firmware_Technische_Daten_PL}}

===Funkcje dodatkowe===
Słuchanie w trybie głośnomówiącym i otwartym
{{Template:Leistungsmerkmale PL - Lizenzen Telefone}}
{{Template:CE-Decl_Phones|Deklaracje zgodności|patrz oddzielny arkusz informacyjny}}
===Nr katalogowy IP112A: 01-00112-001===
===Nr katalogowy IP112-secure: 01-00112-005===
</div>
{{Template:Datasheet_footer|PL}}
[[Category:Specyfikacja techniczna Phones PL|{{PAGENAME}}]]