<html><head><meta http-equiv="Content-Type" content="text/html charset=utf-8"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;" class="">TLS Client Certificate Authentication is what you're looking for. Polycom signs the TLS certificate <i class="">including the MAC address</i>.<div class=""><br class=""></div><div class="">Setup rules in your F5 LTM (or maybe Apache) to enforce this:<br class=""><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span>1. Only deliver Polycom files to Polycom phones</div><div class=""><span class="Apple-tab-span" style="white-space:pre"> </span>2. Only deliver the files for MAC address X if the vendor-signed certificate provided includes MAC address X.</div><div class=""><br class=""></div><div class="">I would stick with Option 66 (or 160) forever. But if you <i class="">need</i> to bootstrap the phones with Option 66, then use permanently-configured settings thereafter, you can actually modify the permanent settings by using a file like this. You have to be sure to deliver this <i class="">as the first file the Polycom phone downloads</i>. </div><div class=""><br class=""></div><div class="">It's not clear in documentation, but Polycom actually has two config file formats: the "master file", and the ordinary config file. SIP Server settings are in the latter, but the "master file" can do special things like specify other files to download, or -- in this case -- reconfigure the phone's provisioning server settings.</div><div class=""><div class=""><br class=""><table border="0" cellspacing="0" cellpadding="0" style="font-family:'Andale Mono';font-size:10px;" class=""></table><span style="font-family:'Andale Mono';font-size:10px;" class="">
</span><pre style="margin: 0px 10px 10px; padding: 5px; background-color: rgb(248, 248, 248); border: 1px dotted rgb(221, 221, 221); overflow-x: scroll; white-space: pre-wrap; color: rgb(51, 51, 51); orphans: 2; widows: 2;" class=""><?xml version="1.0" standalone="yes" ?> <!-- Provisioning Configuration File --> <provision> <device device.set="1" device.dhcp.bootSrvOptType.set="1" device.dhcp.bootSrvOptType="2" device.prov.serverName.set="1" device.prov.serverName="<a href="ftp://aaa.bbb.ccc.ddd" target="_blank" rel="nofollow" style="margin: 0px; color: rgb(74, 105, 143); outline: none; text-decoration: none;" class="">ftp://aaa.bbb.ccc.ddd</a>" device.prov.serverType.set="1" device.prov.serverType="0" device.prov.user.set="1" device.prov.user="abc" device.prov.password.set="1" device.prov.password="def" /> </provision></pre><div class=""><br class=""></div><div apple-content-edited="true" class="">
<font face="Consolas" color="#ff2600" class=""> --- <a href="mailto:mark@ecg.co" class="">mark@ecg.co</a><br class=""> +1-229-316-0013<br class=""> <a href="http://ecg.co/lindsey" class="">http://ecg.co/lindsey</a></font>
</div>
<br class=""><div><blockquote type="cite" class=""><div class="">On Oct 16, 2015, at 15:53 , Carlos Alvarez <<a href="mailto:caalvarez@gmail.com" class="">caalvarez@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><div class=""><div dir="ltr" class="">We don't sell/recommend Polycom, but we have quite a few customers coming to us from other VoIP carriers and they already have them. We have built a provisioning system that will use HTTP, and it works just fine, except we're not sure what the best way to secure it might be.<div class=""><br class=""></div><div class="">The phones can do username/password, but then that means someone has to go put that into every single phone. From what we're able to find, there's no way for option 66 to assign this info permanently (meaning you can remove the option 66 settings after initial config). We don't think we can permanently leave option 66 in place because many customers have a mix of phones, and will need different settings for each type. Also we don't control their internal network, and forcing them to make a permanent change could be challenging.</div><div class=""><br class=""></div><div class="">I'd love to hear how some of you in an ITSP/hosted environment are handling this.</div><div class=""><br class=""></div></div>
_______________________________________________<br class="">VoiceOps mailing list<br class=""><a href="mailto:VoiceOps@voiceops.org" class="">VoiceOps@voiceops.org</a><br class="">https://puck.nether.net/mailman/listinfo/voiceops<br class=""></div></blockquote></div><br class=""></div></div></div></body></html>