GD Secter'a vIPer phone

[helmkamp01]

I am unable to get a sectera viper phone to register with call manager. I have it built as a common 7960 sccp phone profile. When it boots up it will pull an IP address but will not register. This is my first time working with one of these phones and i do not know much about them so any help would be great!

[RAustin70]

Sorry, yes, it was a long few months of trial and error, but I now have many vIPers running on CUCM 14 SU3 as Third Party AS-SIP devices.  in the end the trickiest part was getting the identity certificates right.  The documentation I wrote out have to be scrubbed before I share, but I can provide some general guidance on 3 basic steps:  Creating the Device in CUCM, Configuring the vIPer, and Generating the certificate.  I will work on cleaning up my docs for general use and post.  as an aside, if you know what NPE Portal is and how to use it, this will help immensely.

[RAustin70]

Three documents I used to get ours up and running here at our site are attached here.  I cleared out site specific information.

[tammydh]

Thank you. I greatly appreciate it the work that you put into this to help others out like me. 

[RAustin70]

Apologies, I just realized I missed a step in this documentation that I do.  Once the vIPer certificate is generated, I upload it into CUCM Publisher as a CallManager-trust certificate.  I also made sure the vIPer Certs' root and sub is loaded in there as well.  Overkill?  maybe.

[tammydh]

If it worked, then it's not. 

[tammydh]

Question for you. Why is the cert needed?

[RAustin70]

For this I will refer to the vIPer Admin Guide.  Under section 3.2.11 TLS/SRTP Settings, it states:

NOTE: In SIP or SCCP mode, the vIPer Phone must also be configured with valid certificates and a private key in order for TLS to function properly. Refer to TLS Certificates (page 59) for details

on page 59, 3.2.12 TLS Certificates it further states:

The vIPer Phone uses these certificates for Web Admin TLS sessions, SIP Proxy TLS sessions, and CUCM TLS sessions.

The further down on page 62 3.2.12.1 TLS Certificates Required for SIP, it states:

In both the 2-tier and 3-tier model, the vIPer Phone must have the SIP Proxy’s trusted root certificate loaded as its Trusted Root Certificate.

What this means, is the vIPer certificate needs to have the same Root CA as the CUCM CAllManager Cert for TLS/SRTP to function.  The only way to accomplish this, is to create certificates for the vIPers vs. using any self signed shenanigans.

HTH

Rob

[tammydh]

Thank you for the explanation. That information does help.

[mjack103]

viper phones - secure calls cut out after a few seconds. Phones go secure but won't maintain the call. stays up maybe 10 seconds and shuts down.