In a previous series of articles the configuration and registration of Polycom SIP phones was covered in detail with directions specific to using the previous Polycom Unified Communications Software (UCS) 4.0.x firmware release.  The Lync interoperability story changes quite a bit for these device families in terms of available features and provisioning steps with this new software.  As of the date of this article 16 different Polycom IP desk phones and wireless handsets (Wi-Fi and DECT) have attained Lync Qualification status in Microsoft’s UC Open Interoperability Program with additional devices coming on the horizon.

Supported Devices

The new 4.1.0B software package (version 4.1.0.83139) contains firmware files for the following devices:

  • SoundPoint IP 321, 331, 335, 450, 550, 560, 650
  • SoundStation IP 5000, Duo
  • VVX 500

Additionally SpectraLink 8400 series Wi-Fi handsets have been Qualified for Lync interoperability since August and the separate 4.1.0 software package (version 4.1.0.73405) for these devices has been available for a few months already.

  • SpectraLink 8440, 8450, 8452

It is also worth pointing out that a number of Polycom KIRK DECT Wireless handsets are also Lync Qualified but these do not run the UCS firmware common to the rest of the Polycom SIP phones.  These DECT products utilize a different application paired with a wireless server for Lync connectivity and will not be addressed in this article.

Supported Features

All of these supported and qualified devices will share the same base firmware provided by the UCS 4.1.0 software release which utilizes a completely new, and streamlined provisioning process.  The Polycom server-based provisioning process is still available for large deployments, but for dealing with small numbers of devices or end-user provisioning there is a new Out of the Box (OOTB) user experience that is much simplified over the previous process.  In most environments there is no longer any requirement to use any XML configuration files as documented in this previous article.

The different 4.1.0 and 4.1.0B software releases are functionally identical and are provided as separate packages for the Wi-Fi and wired devices.  The Lync Qualified capabilities and features are identical across all devices, with a few minor exceptions based on capabilities of the physical device itself.

The following lists of features are categorized as either Lync-specific features or traditional SIP phone features.

imageimage

This new version is capable of downloading a private CA root certificate used by the Lync Server in the same fashion that the existing Lync Phone Edition devices operate.  This requires that DHCP Option 43 is properly configured for the target Lync environment and the phones have access to the Lync Server Certificate Provisioning web service over both HTTP (TCP 80) and HTTPS (TCP 443).

If the phone is located externally and is connecting to a Lync Edge Server then there will be no need to download the certificate as the Edge Server would be deployed using a publically trusted third-party certificate authority (like Entrust, GoDaddy, etc).  Only internally registered phones will need to download a certificate chain when the Lync Front End servers (and Directors, if applicable) are using certificates issued by an internal private CA.

Out of the Box Experience

This article will walk through the simplified setup process using the Polycom VVX 500 paired with 4.1.0B software as an example.  The same process can be used for any of the other supported devices although the location and ordering of some of the menus, as well as some multi-key combos (MKC) may differ between device models and families so consult the specific model’s administration guide on the Polycom Support website for additional assistance.  The process shown in this section is only available starting with the 4.1.0.x release of the UCS firmware.

Verify Firmware Version

To confirm the currently installed software either check on the phone itself or access the phone’s web browser interface.

  • To check the software version from the device interface press the physical Home button and then tap the following menu items: Settings > Status > Platform > Application > Main and note the reported Version number.

image

Select Lync Base Profile

In the previous 4.0 release it was required to provide a number of configuration settings specific to Microsoft Lync registration via an XML configuration file, either manually or via a centralized provisioning server.  As stated before it is still possible to use the centralized server to provide additional custom parameters if desired, but for simply locating and registering to a Lync Server no configuration file is needed in the 4.1 release.  These required parameters are built-in to the new firmware and simply need to be enabled by selecting a special base profile for the device.

The various Polycom SIP phone models use different Multi-Key Combo (MKC) shortcuts to access the Base Profile menu.

SoundPoint IP 3xx, 4xx Series 1, 2, 4, 5
SoundPoint IP 5xx, 6xx Series 5, 7, 8, *
VVX & SpectraLink 84xx Series 1, 4, 9

Alternatively, instead of using the Multi-Key Combo (MKC) the Base Profile menu can be accessed manually by navigating to Settings > Advanced > Administration Settings > Network Configuration > Base Profile.

  • From any screen on the VVX 500 simply press and hold the 1, 4, and 9 keys on the phone.  The dialing screen will appears but after a few seconds the phone should then display the Base Profile menu, prompting for a password.  Enter the defined Admin password (the default value is ‘456’).

image     image

  • On the Base Profile menu select the Lync profile and the phone will immediately reboot.

image

Sign In to Lync

After the device reboots it will automatically bring up the Sign In menu. If the device does not automatically present this menu then it can be accessed manually from by navigating to Settings > Features > Microsoft Lync > Sign In.

  • Using the on-screen keyboard enter the Lync SIP Address and Active Directory credentials for the desired account and then tap the Sign In button.  Using the on-screen keyboard (the icon in the upper right-hand corner) enter the account address and credentials for the desired Lync user.

image     image

  • The Sign-in Address value should be populated with the Lync account’s SIP Address (e.g. jeff@mslync.net).
  • The Domain name can be entered in either NetBIOS format (e.g. SCHERTZ) for DNS format (e.g. schertz.local).
  • The User field should be populated with the Active Directory account username (e.g. jeff).

The User format used must match the format selected for the Domain field, meaning that if the NetBIOS domain name is used then the sAMAccountName value should be entered.  Yet if the DNS domain name is instead used then make sure to also use the associated username portion from the User Principal Name.  Most often the username values are identical, but that is not always the case so do not make any assumptions.  This blog article explains Active Directory naming formats in greater detail.

The formats are essentially split into two fields so do not enter the entire format in either field (e.g. SCHERTZ\jeff or jeff@schertz.local) as this is incorrect; the domain and username values must be entered separately into their own fields.

  • The Password field is self-explanatory.

After submitting the user credentials the phone may take a few seconds to register, depending on if a private root certificate needs to be downloaded or not.

Once the registration is complete then the main screen will be updated to reflect the successful sign-in attempt.

image     image

Some of Lync user’s contacts may then be displayed on the main screen.  These contacts are any pinned Frequent Contacts for that Lync user.  (These are not the frequent contacts added automatically by the Windows Lync client which will appear below the horizontal bar in the Frequent Contacts group.)  So to customize the phone’s main screen the user can use their Windows Lync client to manually pin specific contacts.

image     image

At this point the phone is registered to Lync and all of the features provided by a Lync Qualified device are available for use.  Refer to the official Polycom device documentation for more details on how to utilize some of the new features.

Optional Steps

Some additional configuration steps may be desired or required depending on the environment in use or if the previous OOTB procedure has failed to connect to the Lync Server.

Sign In to Exchange Server

This additional configuration is only required for Calendar integration as the previous Lync registration is sufficient for Voice Mail access when using Exchange Unified Messaging.

  • To identify the IP address currently assigned to the phone press the physical Home button and then tap the following menu items: Settings > Status > Network > TCP/IP Parameters > and note the reported IP address.

image

  • Connect to this IP address in a web browser and provide the administrator password (‘456’ by default).
  • Browse to the Settings >  Applications menu and expand the Exchange Applications section.
  • Select Enable for the Exchange Calendar setting.
  • Populate the Exchange Server URL field with the complete URL for Exchange Web Services (EWS) on the desired Exchange Client Access Server. (e.g. https://exchange.schertz.local/EWS/exchange.asmx).  Do not enter just the Exchange server FQDN, the entire EWS URL must be specified.
  • Optionally select Disable for the Reminder setting to prevent the phone from beeping and displaying meeting invitation reminders prior to scheduled meeting if this behavior is not desired.

image

  • Click Save to write the configuration changes to the phone, which will automatically reboot the device.  The same user credentials which were entered in the phone for Lync registration are used to perform NTLM authentication against the Exchange Client Access Server for access to the calendar data in the user’s mailbox.

After the phone restarts the Home screen will include a new Calendar button which can be used to display the contents of the user’s Exchange Calendar.

image     image

Adjust Time Offset

By default the phone will display the time in GMT so although the time will be accurate to the minute when provided by a Network Time Server the hour display may need to be adjusted for the proper time zone.

  • To change the time zone press the physical Home button and then tap the following menu items: Settings > Advanced > Administration Settings > Network Configuration > GMT Offset and then select the desired offset value (e.g. -6 for Central Time).

image

Tap the Back key and then select Save Config when prompted to commit the change to the phone.  The proper time will then be displayed on the main screen.

Verify Certificate Trust

When DCHP Option 43 is configured to provide internal devices with the Lync Server Certificate Provisioning URL then the device will automatically download and install the root certificate into the following location..

  • To verify the root certificate was successfully downloaded press the physical Home button and then tap the following menu items: Settings > Advanced > Administration Settings > TLS Security > Custom CA Certificates and then scroll down to the bottom of the list to the Application CA 6 container.

image_thumb60_thumb

  • To instead use the web management interface to verify the root certificate was downloaded simply connect to the IP address of the device in a web browser, provide the Admin password (default value is ‘456’) and browse to the Settings > Network > TLS menu and check that the Application CA 6 container displays an installed root certificate.

image_thumb72_thumb

By Jeff Schertz

Site Administrator

39 thoughts on “Polycom Qualified Lync Phone Configuration”
  1. Hi Jeff,

    Great Post – I am interested in your thoughts on the VVX500 with Lync. Would you recommend it over say a CX600?

    1. Matt, this depends on the use-case. There are features and capabilities that the Qualified phones like the VVX500 provide beyond the CX platform, while there are still some features that only the CX platform provides. In many cases there may be place for both devices depending on what is needed. I may do a separate article on this topic alone as it is multi-faceted.

      1. As of late Nov 2013 when I tried a VVX500 and VVX600 with Lync 2013 CU2 I thought it was the worst piece of hardware and use of Lync API I've ever run across. There were so many bugs it was not usable in my opinion, certainly not worthy of putting in front of a user. We deployed Polycom CX500 (couple guest closets), CX600 to user desks (nearly 300 units) and CX3000 (15 units) to the conference rooms. Love it. UCUpates of these devices all work with 1 single update… import into Lync then push to a test device, then push to all and you have a rollback to previous version option. I have heard rumor Lync Phone Edition development is ending in favor of having vendors like Polycom use their own OS (VVX500/600) and write to Lync APIs for the Lync functionality (connectivity per the method shown in this article). Polycom better step it up if the VVX line is going to work for Lync. Yuck and yuck was my experience. Taken with a grain of salt… I haven't looked to see what they have done to improve it in 2014 releases of their VVX OS, but we committed to CX500/600/3000 and are happy with that choice.

        1. David, it's unfortunate that you've had these issues with the newer VVX devices. Many of the Lync features in the UCS firmware are new, yet feature-parity and stability are the core focus right now. The Lync Phone Edition devices have the advantages of (1) being over three years old and benefit from over 11 separate cumulative updates full of bug fixes and (2) the software was written by the same product group as the actual Lync clients. The VVX is not positioned as a replacement for the CX phones as they target quite different use cases, so those who are happy with the Lync Phone Edition experience should continue to stay on those devices for some time yet. In the future there will be feature parity between the Optimized LPE experience and qualified third-party devices for that day when the LPE software is no longer applicable.

  2. Great article, thanks Jeff – I cant seem to find a config file description or admin manual for the 4.1 uc software, do you know of a way to set the base profile in a config file for the ip450? I'd imagine this would be the only config directive needed apart from certs.

    1. The MKC for the 450 is "1,2,3,4". But you can always navigate to the Base Profile menu manually as I described in the article.

  3. Great detail here Jeff – thank you! It seems that the latest firmware available for download on the Polycom site is 4.0.3 RevF for the VVX500. Can you provide a link to download the 4.1 or 4.1B Firmware?

    Thanks,

    Tino

    1. As mentioned in the article the latest 4.1.0B Lync software is not available on the public download site, you need to contact your Polycom device vendor to request the software.

  4. Hi Jeff, Have you heard of anyone getting a Soundstation IP 7000 to work with Lync? My predecessor got it to work once. But I erased the configuration by accident.

    1. Although the IP7000 uses the same software stack as the other devices it is not a Lync-supported device. You can use the same approach as described in the older articles for the 4.0.x release and it may work but is completely unsupported. There is no 4.1.0B release for the IP 7000/6000 models as neither are Lync supported.

        1. I know this is old but here it goes. I am having trouble registering a ip 5000 conference phone to Skype for Business. it is running the latest firmware (4.4.1.0731 I believe) but cant get it registered. is that firmware (published in 2015 supported against skype for business? Also, is there a guide for manually configuration of that phone for S4B. I believe it is having trouble downloading internal root ca and would like to see the manual way to install the necessary certs.

          1. I don’t know about support for SfB versions that old but the guidance I have on this site which covers importing server certificate chains is applicable to all UCS based devices, so it’s valid for the IP5000.

    1. The CX phones do not, but Qualified devices like the Polycom VVX do support the ability to register to a third-party paging system.

  5. hi Jeff, I am trying to get a SoundPoint IP 335 with firmware version 4.1.0.84097 working in combination with a Lync Edge server. De internal Lync directors do have self signed certifcates and the Edge server has public (Godaddy) certificates. On the phone log I get these errors:

    1210200325|sip |4|03|CTcpSocket::TlsListenThread: SSL_get_error Error code=5
    1210200325|sip |4|03|TLS Listen Thread Exit
    1210200325|sip |5|03|Send SSL_get_error nLen -1 nError 5 = error:00000000:lib(0):func(0):reason(0)
    1210200422|sip |4|03|CTcpSocket::TlsListenThread: SSL_get_error Error code=5
    1210200422|sip |4|03|TLS Listen Thread Exit
    1210200422|sip |5|03|Send SSL_get_error nLen -1 nError 5 = error:00000000:lib(0):func(0):reason(0)

    I have even imported the CA root from our internal domain controller, but the error remains.bDo you have any suggestions? Thanks Alex

    1. There is no reason to import the internal CA certificate onto the phone if you have a trusted GoDaddy certificate issued to the Access Edge service. I'm actually using GoDaddy certificates on at least 2 of my test environments and have been registering multiple phones since early alpha builds last summer, so there should be no additional configuration needed. Make sure you don't have any old configuration left over from early 4.0.x configurations, I suggest performing a factory reset.

      1. Thanks a factory reset works. Now I have this strange behavior. We are running a project to see if the IP 335 can be used with our Hosted Lync setup. We are using the 4.1.084097 firmware on several phones as a pilot for a client who wants to buy many IP 335 or IP 321 models to rollout.

        In our Lync deployment other CX600/700 series phones do work fine. All phones are external so they do connect to an Edge server.

        Initial setup works fine. We are able to call internal and external numbers. Quality is fine also. The only problem is that after a certain amount of time (+1 hr) only internal lync users can be called. All other calls to external numbers calls fail. Resetting the phone helps, but again the problems comes back after more than 1 hr of inactivity.

        Is this a known problem?

        Thanks
        Alex.

  6. Alex, that is not an issue that I'm aware of; I suggest contacting Polycom support if you have not already done so.

  7. […] This article is not intended to replace or accompany any official Polycom documentation.  Instead this process alone can be used to deploy a basic provisioning server in a lab or testing environment when evaluating Polycom SIP phones, and much of the guidance contained reflects a non-production scenario.  Also note that some of this guidance differs from instructions found in the official Polycom provisioning guides, most importantly the guidance to use a large number of parameters which no longer need to be defined for Lync interoperability as of the introduction of the Lync Base Profile. […]

  8. Alex/Christohphe/Jeff, any updates on the issue? Haven't seen anything that sounds like this particular problem, so I'm just curious. I'd be especially curious to see logs from the client to see what the failure looks like.

    1. Duncan, I've had no other reports of this so far. Curious if either Alex or Christophre had contacted the support team yet.

  9. Very nice article, thank you for sharing. One question, with this lab setup, I assume the password and usernames stored in the configuration files are sent over the wire in clear text? To lock this down, could we use HTTPS instead of FTP? Can DNS options 43 and 120 be used to ensure the device downloads the CA root cert so that the initial SSL connection to the web server works?

    Thanks again for a great article.

    Lex

    1. Lex, that is correct. Ideally you want to configure DHCP 43 and then there is no need to include the certificate in the provisioning files. Additionally if you use a secure file transfer protocol then any username/password information stored in the phone configuration files will not be transfered in clear text across the network.

  10. Hi Jeff
    This is really a good post. I setup a VVX500 now, however I cannot register the phone to Lync 2013 enterprise. I checked the phone and also have Application CA6 cert from internal CA. Other certs are empty, is it correct?
    One more concern is what is the difference between platform CA and application CA. When will we need to install all?
    Thanks a lot Jeff

    1. If you see CA6 populated that indicates a successful root certificate download via DHCP Option 43 configuration. You shouldn't need to install anything else so there may be a different cause, possibly an authentication failure.

  11. Hi!

    We have a SoundPoint IP 560 and we are having trouble configuring it with Lync 2013. We see configuration option for Lync 2010 and not for Lync 2013. Following are the phone details:

    Phone Model SoundPoint IP 560
    Part Number 2345-12560-001 Rev:T
    UC Software Version 4.1.0.84959
    BootROM Software Version 5.0.2.12692

    Can anyone help please?

      1. Hi Jeff, I was able to get the SSL certificate issue fixed but now I have issue signing. It says " cannot sign in. please verify sign-in address, domainusername and password".

        I am using Polycom cx600 with ver. 4.0.75.76.0

        Please suggest.

        Thanks in advance

  12. I am having an issue I cannot resolve. I have a Lync 8440 phone that will connect to my lync server and login and function as expected. I have a client we are trying to setup and I cannot get the phone to login to their site. I get Microsoft Lync login has failed. Yet I am able to use the same login and login and function using the Lync client. What am I missing?

    Thanks

    1. Impossible to say what the root cause for this might be, but it sounds more related to the environment than the phone itself. I have not used the SpeactraLink handsets since they were spun off into their own company a few years ago, so I'm not familiar with the latest firmware for them either.

  13. hello Jeff

    we have polycom410 and users logged using the sip lync account, earlier they used to view the voice messages that was getting popped up .as UM was enabled for them .

    the issue started when users mailboxes moved to o365 from onprem exchange servers however lync servers are still on-prem

    they are receiving the voice messages over email but not visible in polycom410

    can you suggest what can be done.

Leave a Reply

Your email address will not be published. Required fields are marked *