Grandstream Networks WP810 Manuel utilisateur

Grandstream Networks, Inc.

WP810

Cordless Wi-Fi IP Phone

Security Guide

P a g e | 1

WP810 Security Guide

Table of Contents

OVERVIEW.....................................................................................................................3

WEB UI/SSH ACCESS ...................................................................................................4

Web UI Access .....................................................................................................................................4

Web UI Access Protocols .....................................................................................................................4

Admin Login..........................................................................................................................................5

User Management Levels ....................................................................................................................6

SECURITY FOR SIP ACCOUNTS AND CALLS ............................................................8

Protocols and Ports ..............................................................................................................................8

Anonymous/Unsolicited Calls Protection .............................................................................................9

SRTP .................................................................................................................................................. 11

SECURITY FOR WP810 SERVICES............................................................................12

Firmware Upgrade and Provisioning ..................................................................................................12

TR-069................................................................................................................................................13

Syslog.................................................................................................................................................15

SECURITY GUIDELINES FOR WP810 DEPLOYMENT .............................................. 16

P a g e | 2

WP810 Security Guide

Table of Figures

Figure 1 : Web UI Access Settings................................................................................................................4

Figure 2 : Web UI Login ................................................................................................................................5

Figure 3 : Change Password on First Boot ...................................................................................................5

Figure 4: Change Admin Level Password.....................................................................................................6

Figure 5 : Change User Level password.......................................................................................................7

Figure 6 : Configure TLS as SIP Transport ...................................................................................................8

Figure 7 : SIP TLS Settings...........................................................................................................................8

Figure 8 : Additional SIP TLS Settings ..........................................................................................................9

Figure 9 : Anonymous Call Rejection............................................................................................................9

Figure 10 : Settings to Block Anonymous Call ............................................................................................10

Figure 11 : SRTP Settings...........................................................................................................................11

Figure 12 : Upgrade and Provisioning ........................................................................................................12

Figure 13 : TR-069 Connection Settings.....................................................................................................14

Figure 14 : Syslog Protocol .........................................................................................................................15

P a g e | 3

WP810 Security Guide

OVERVIEW

This document presents a summary of security measures, factors, and configurations that users are

recommended to consider when configuring and deploying our WP810 Cordless Wi-Fi IP Phone.

Note: We recommend using the latest firmware for latest security patches.

The following sections are covered in this document:

•Web UI/SSH Access

Web UI access is protected by username/password and login timeout. Two-level user management is

configurable. SSH access is supported for mainly troubleshooting purpose and it is recommended to disable

it in normal usage.

•Security for SIP Accounts and Calls

The SIP accounts use specific port for signaling and media stream transmission. It also offers configurable

options to block anonymous calls and unsolicited calls.

•Security for WP810 Services

WP810 supports service such as HTTP/HTTPS/TFTP/FTP/FTPS and TR-069 for provisioning. For better

security, we recommend using HTTPS/FTPS with username/password and using password-protected XML

file. We recommend disabling TR-069 if not used to avoid potential port exposure.

•Deployment Guidelines for WP810

This section introduces protocols and ports used on the WP810 and recommendations for routers/firewall

settings.

This document is subject to change without notice.

Reproduction or transmittal of the entire or any part, in any form or by any means, electronic or print, for

any purpose without the express written permission of Grandstream Networks, Inc. is not permitted.

P a g e | 4

WP810 Security Guide

WEB UI/SSH ACCESS

Web UI Access

The WP810 embedded web server responds to HTTP/HTTPS GET/POST requests. Embedded HTML

pages allow users to configure the device through a web browser such as Microsoft IE, Mozilla Firefox,

Google Chrome and etc. With this, administrators can access and configure all available WP810 information

and settings. It is critical to understand the security risks involved when placing the Cordless Wi-Fi IP

Phones on public networks and it’s recommended not to do so.

Web UI Access Protocols

HTTP and HTTPS are supported to access the WP810’s web UI and can be configured under web UI →

Maintenance → Security settings → Security.

To secure transactions and prevent unauthorized access, it is highly recommended to:

1. Use HTTPS instead of HTTP.

2. Avoid using well known port numbers such as 80 and 443.

Figure 1 : Web UI Access Settings

3. The WP810 allows access via SSH for advanced troubleshooting purpose. This is usually not

needed unless the administrator or Grandstream support needs it for troubleshooting purpose. SSH

P a g e | 5

WP810 Security Guide

access on the device is enabled by default with port 22 used. It’s recommended to disable it for

daily normal usage. If SSH access needs to be enabled, changing the port to a different port other

than the well-known port 22 is a good practice.

Admin Login

Username and password are required to log in the WP810’s web UI.

Figure 2 : Web UI Login

The factory default administrator username is “admin”, and the random password can be found on the

sticker at the back of the unit. Changing the default password at first time login is highly recommended.

When accessing the WP810 phones for the first time or after factory reset, users will be asked to change

the default administrator password before accessing WP810 Web interface.

To change the password for default user "admin", navigate to Web GUI → Maintenance →Web Access

Figure 3 : Change Password on First Boot

P a g e | 6

WP810 Security Guide

Figure 4: Change Admin Level Password

The password length must be between 6 and 25 characters. Strong password with a combination of

numbers, uppercase letters, lowercase letters, and special characters is always recommended for security

purpose.

User Management Levels

Two user privilege levels are currently supported:

•Admin

•User

User Level

Username

Password

Web Pages Allowed

User Level

user

123

Only Status and Basic

Settings

Administrator Level

admin

Random password available

on the sticker at the back of

the unit.

All pages

NOTES:

➢It is recommended to keep admin login for administrator only. And user should be provided with

user level login only, if web UI access is needed.

➢Change User Level Password upon the first login by following the below steps:

1. Access your WP810 web UI by entering its IP address in your favorite browser.

2. Enter your admin password.

3. Go to Maintenance → Web Access → User Password and Enter the new password.

4. Confirm the new password.

5. Press “Save” at the bottom of the page to save your new settings.

P a g e | 7

WP810 Security Guide

Figure 5 : Change User Level password

P a g e | 8

WP810 Security Guide

SECURITY FOR SIP ACCOUNTS AND CALLS

Protocols and Ports

By default, after a factory reset, all the accounts are not active. And it is recommended to disable the unused

ports. Under Web GUI → Accounts → Account X → General Settings → Account Active: “No”

➢Users can also disable Direct IP calls on all ports under Settings → Call Features: Set “Disable

Direct IP Call:” to “Yes”

•SIP transport protocol:

The WP810 supports SIP transport protocol “UDP” “TCP” and “TLS”. By default, it’s set to “UDP”. It’s

recommended to use “TLS” so the SIP signaling is encrypted. SIP transport protocol can be configured

per Account under web UI → Accounts → Account X → SIP Settings → Basic Settings. When “TLS”

is used, we recommend using “sips” instead of “sip” for SIP URI scheme to ensure the entire SIP

transaction is secured instead of “best-effort”.

Figure 6 : Configure TLS as SIP Transport

SIP TLS certificate, private key and password can be configured under Maintenance → Security Settings

→ Security page:

Figure 7 : SIP TLS Settings

P a g e | 9

WP810 Security Guide

When SIP TLS is used, the WP810 also offers additional configurations:

- Validate Server Certificates:

This feature allows users to validate server certificates with our trusted list of TLS connections

- Trusted CA Certificates: Uses the certificate for Authentication under Maintenance → Security

Settings → Trusted CA Certificates

Figure 8 : Additional SIP TLS Settings

•Local SIP port when using UDP/TCP:

Starting from 5060 for Account 1, the port numbers increase by 2 for each account. For example, 5062

is the default local SIP port for Account 2.

•Local SIP port when using TLS:

The SIP TLS port is the UDP SIP port plus 1. For example, if Account 1 SIP port is 5060, its TLS port

would be 5061.

Anonymous/Unsolicited Calls Protection

If the user would like to have anonymous calls blocked, please go to WP810’s Web GUI → Account X →

Call Settings and set “Anonymous Call Rejection “to “Yes”: The WP810 will then reject all incoming

calls with anonymous caller ID by sending a “486 Busy here” message.

Figure 9 : Anonymous Call Rejection

Autres manuels pour WP810

Table des matières

Autres manuels Grandstream Networks Téléphone IP

Grandstream Networks

Grandstream Networks GXP-285 Manuel utilisateur

Grandstream Networks

Grandstream Networks GRP26 Series Manuel utilisateur

Grandstream Networks

Grandstream Networks GXV3370 Manuel utilisateur

Grandstream Networks

Grandstream Networks GXV-3000 Manuel utilisateur

Grandstream Networks

Grandstream Networks GXP1610 Manuel d'instructions

Grandstream Networks

Grandstream Networks GXV3240 Manuel utilisateur

Grandstream Networks

Grandstream Networks GXV3275 Manuel utilisateur

Grandstream Networks

Grandstream Networks GXP2100 Manuel utilisateur

Grandstream Networks

Grandstream Networks GXP2130 Series Manuel utilisateur

Grandstream Networks

Grandstream Networks 100 Series Manuel utilisateur

Grandstream Networks

Grandstream Networks GHP620 Manuel utilisateur

Grandstream Networks

Grandstream Networks GXP1620 Manuel utilisateur

Grandstream Networks

Grandstream Networks 100 Sereis Manuel utilisateur

Grandstream Networks

Grandstream Networks BudgeTone 200 Manuel utilisateur

Grandstream Networks

Grandstream Networks GXP2170 Guide d'installation

Grandstream Networks

Grandstream Networks GRP2624 Manuel utilisateur

Grandstream Networks

Grandstream Networks GXV-3140 Manuel utilisateur

Grandstream Networks

Grandstream Networks GXP2160 Guide d'installation

Grandstream Networks

Grandstream Networks GXV-3140 Manuel utilisateur

Grandstream Networks

Grandstream Networks GXV3275 Manuel utilisateur

Grandstream Networks

Grandstream Networks GXV3370 Manuel utilisateur

Grandstream Networks

Grandstream Networks BroadWorks BLF GRP260X Manuel utilisateur

Grandstream Networks

Grandstream Networks GXP-280 Manuel utilisateur

Grandstream Networks

Grandstream Networks DP715 Manuel utilisateur

Manuels Téléphone IP populaires d'autres marques

Alcatel

Alcatel 4028 Manuel utilisateur

Polycom

Polycom Polycom VVX 600 Manuel utilisateur

Polycom

Polycom SoundPoint IP 450 Manuel utilisateur

Cisco

Cisco SPA-500 Series Manuel utilisateur

Polycom

Polycom SoundPoint IP 650 Manuel utilisateur

Proximus

Proximus Maestro 3016 IP Manuel utilisateur

Fanvil

Fanvil X4 Manuel utilisateur

Cisco

Cisco 7962 Manuel utilisateur

Snom

Snom 320 Manuel utilisateur

Yealink

Yealink Yealink SIP-T46G Manuel utilisateur

Avaya

Avaya 4625SW Manuel utilisateur

Yealink

Yealink SIP-T52S Manuel utilisateur

Nortel

Nortel 1140E Manuel utilisateur

Nexotek

Nexotek NT-P500 Manuel utilisateur

Avaya

Avaya Integral 5 R3.0 Manuel utilisateur

GE 28320EE2 - Dect 6.0 InfoLink 2 Manuel utilisateur

Avaya

Avaya 4600 Series Manuel de service

Mitel

Mitel MIVOICE OFFICE 400 6940 SIP Manuel utilisateur