• Firmware Upgrade D-link
• Polycom Cx700 Skype For Business
• Netgear Router Firmware Upgrade

Device Updates (firmware upgrade) with Lync 2010 I connected Aastra 6725ip phone this morning. Polycom CX700 and LG-Nortel IP Phone 8540. Latest Polycom UC Software Release. Certificate Updates for Polycom UC Software Technical Update 5.7. Free download easy recovery for windows 7 64 bit. Polycom UC Software in a Microsoft Lync Server. The Polycom CX700 IP Phone is designed specifically for use with Microsoft Office Communications. Microsoft Lync 2010 Phone Edition for CX700 IP Phone.

Any Tanjay family device (Polycom CX700, LG-Nortel 8450) currently running a Communicator Phone Edition (CPE) release (1.x or 3.5.x) cannot update directly to the Lync Phone Edition (LPE) CU6 (4.0.7577.4100) release due to a change in the way the newest firmware package was created.

For clarification the Cumulative Update for June 2012 release is commonly referred to as Cumulative Update 6 (CU6) and the previous March 2012 release was Cumulative Update 5 (CU5). Although official Microsoft documentation for Lync will not use the numeric identifiers for the various releases, throughout unofficial articles and technical forum discussions the CU nomenclature is widely used.

This can cause problems as newly purchased Tanjay devices will still ship with the older OCS firmware version because the CX700 is the only Lync Phone Edition devices supported with Office Communications Server. As there is no supported downgrade process to go from a newer Lync 4.x version down to an older OCS 3.5.x version then shipping these devices pre-installed with Lync firmware would prevent deployments still utilizing OCS from using the phones. (For an unsupported rollback procedure see Chris Lehr’s blog article.)

Workaround

Instead the device will need to first be updated to any previous Lync version (4.0.7576.0 through 4.0.7577.4066) and once that is complete then it can then be upgraded to the .4100 (CU6) release successfully.

But when Microsoft releases a new cumulative update the previous version is replaced on their download site, so only the latest version is ever available for download.

Until Microsoft provides a link to download a previous version of the firmware the February 2012 (CU5) update file for the Tanjay devices can be downloaded directly from here:ucupdates_tanjay_cu5.cab

In the event that the latest update has already been approved on the Lync Server then an earlier version needs to be restored.

• Using the Lync Server Control Panel navigate to the Clients > Device Update section and highlight the line for the desired device (e.g. CX700). In the following example the .4100 version has already been approved.

• Select Restore from the Action menu to activate the previously used .4066 version.

Root Cause

To understand the cause of this issue the individual firmware packages can be opened to identify what has changed between previous Cumulative Updates and the most recent June 2010 release (CU6).

• Browse to the DeviceUpdateStore folder on the Front End pool file share and open any of the Tanjay family devices. The example below shows all installed firmware versions for the Polycom CX700 for English packages on Hardware Revision A devices. The available versions shown below are the RTM release (.0) the CU5 package (.4066) and the CU6 package (.4100).

lyncshare1-WebServices-1DeviceUpdateStoreUCPhonePolycomCX700AENU

• Open the 4.0.7577.4066 folder and browse down to the expanded firmware files as shown below.

• Open the CPE.bat file to view the Security Catalog information in Windows Explorer which will display details about the certificate used to sign the digital package. Then click the View Signature button on the General tab to view additional details about the digital signature.

• On the Digital Signature Details window click the View Certificate button on the General tab to show the actual digital certificate information.

• On the package Certificate window switch to the Certification Path tab, then highlight the Microsoft Root Authority object in the path and then click the View Certificate button. This will open the certificate details for the root certificate authority used to sign the certificate on this firmware package.

• On the root Certificate window switch to the Details tab, taking note that the Signature Algorithm used to sign the root certificate authority certificate is MD5 (Message-Digest Algorithm). Also note the name “Microsoft Root Authority”.

• Now return to the original folder containing the different packages and then browse down to the CPE.cat file stored in the latest 4.0.7577.4100 (CU6) package.

• Perform the exact same steps as before to locate and identify the Signature Algorithm on the root certificate authority certificate sued for the .4100 package. Notice that this package is now signed using SHA1 (Secure Hash Algorithm), and not MD5. Also note that the root CA is different

When comparing the root certificates side-by-side the unique names (Microsoft Root Authority versus Microsoft Root Certificate Authority) indicate that these packages were singed by completely different CAs using different signature algorithms and different key lengths. (Note that the validity periods on both CAs are still nowhere near the expiration dates.)

The root cause is that the newer root certificate authority certificate used to the sign the certificate issued to the firmware package has changed in the 4.0.7577.4100 (CU6) release. All Lync Phone Edition packages prior to CU6 have always used an MD5 algorithm. MD5 is an older cryptographic hash function that has long been known to be unsuitable for use in digital signatures and most current applications have migrated to at least SHA1, if not beyond to SHA2.

Firmware Upgrade D-link

On the surface this should not present too much of a problem as this is not a widespread issue since all Lync Phone Edition client versions (4.x) are compatible with both MD5 or SHA1 algorithms. But the earlier Communicator Phone Edition client versions (1.x and 3.5.x) are not compatible with the newer SHA1 format.

Since all newer Aries models phones have only ever shipped with the Lync 4.x versions, then the only devices impacted by this incompatibility are the Tanjay family devices. Thus when a device running any version prior to 4.x downloads the 4.0.7577.4100 package it will not be able to validate the issuing certificate authority’s certificate and will fail to install the update in the inactive partition.

This is why the update must now be a two-step process in that any Cumulative Release prior to CU6 must be installed on the Tanjay first. And once it has a working 4.x version then the latest 4.0.7577.4100 release can be approved and successfully installed on it. It is also safe to assume that future updates (e.g. CU7) will continue to use the newer root certificate authority so this two-step process will most likely still be required.

This process can be used on any of the Polycom SIP Phones which support 4.x software today (SoundPoint IP, SoundStation IP, VVX, and SpectraLink models).

This only applies to devices which are already running at least version 4.0.0 of the UCS firmware. In previous versions (Polycom SIP software 3.x or earlier) this manual process was not available. Also the firmware was packaged differently in the previous SIP versions as the device firmware was provided as two separate binary files, the bootloader image and the application image. In the 4.x UCS release these were merged into the same binary file. New devices like the VVX500 and SpectraLink phones have only ever shipped with 4.x UCS releases, while older devices like SoundPoint IP phones may still have previous 3.x SIP releases on them. In order to utilize Lync integration a one-time update process must first be used to upgrade devices running 3.x to 4.x.

This process can be used on any of the Polycom SIP Phones which support 4.x software today (SoundPoint IP, SoundStation IP, VVX, and SpectraLink models).

Updating Firmware

The Polycom SIP phones support a few different methods for software updates, most commonly utilizing a central FTP provisioning server so that all devices will check a single distribution point for configuration changes and new firmware images. The previous article mentioned above contains links with more details on enterprise deployment and management practices.

But when trying to update the firmware for a few phones there is a new process which was introduced with the 4.0 release of UCS. This process allows the device to be manually pointed to a Polycom hosted web server distribution point on the Internet to download and install new firmware packages from. As of the writing of this article the Lync specific firmware release is not yet included on the Polycom Hosted Server, so primarily Open SIP only firmware releases will be available using this method. This same process can also be used to download files from a custom distribution server for use with the Lync Qualified releases, as covered in the next section of this article

• Identify the IP address assigned to the first phone to be upgraded by navigating on the device to the Settings Menu > Status > Network > TCP/IP Parameters and check the IP value.

• Connect to the IP address of the phone using a web browser.

Polycom Cx700 Skype For Business

• When prompted for login information select Logon As Admin and enter ‘456’ which is the default password (or the custom administrator password assigned to the specific phone, if one was previously set).

• From the Utilities menu select Software Upgrade. Verify that the Server Type is set to Polycom Hosted Server and then click the Check for Updates button.

• If the connection is successful then a list of currently provided software versions will be returned.

• Select the desired version (if there is more than one listed) and click the Install button. This will trigger a reboot of the phone and begin the update process.

• Immediately after rebooting the phone should report the status of “Updating, Please Wait” followed soon after by “Downloading new Updater…”. This status bar here will indicate the completion of downloading the .sip.ld binary file for the desired update version for the specific phone model.
• The phone will then report “Updater updated, rebooting” and then after the reboot should report “Downloading new application”. Once this process is complete the device update will be complete and it will start the application interface. Any configuration settings previously entered will be retained.

Normally only the latest version will be provided on the Polycom Hosted Server, but this central distribution point may not include the most recent versions released depending on what features or capabilities were introduced in the last release. For example the recent 4.1 release is only providing Lync-specific features so devices currently used with other SIP platforms (.e.g Broadsoft, Avaya, Nortel, etc) should not install this update and should remain on 4.0 software for now.

For this reason it may be necessary to download the available software package for the 4.1 release and then create a custom distribution server to point the devices to.

Using Custom Software Distribution

To create a custom software distribution a software package must first be downloaded, the firmware files extracted, and then a configuration file created and modified. There is still some initial setup required but this is a basic as creating a single XML file and then dropping it an the desired firmware files directly into any web server directory. For engineers looking to carry phones around to different sites for demonstration purposes then selecting a web server on the Internet makes it very easy to update the phones over the Internet, while for supporting updates for a handful of devices on an internal network then utilizing an existing web server is ideal. Either way once the directory is setup then any device can be manually pointed to the directory and the phone will utilize HTTP to download and apply the firmware. Also this process can be used to downgrade software if needed as multiple versions can be stored in the same location and a menu will be presented to allow the desired version to be installed.

All currently available versions of the Polycom UCS can be located in the official software release matrix online as well as on the product support page for any model SIP phone. Always make sure to download the Split version of any versions as two different types of packages are provided: a Combined package with all firmware files for all phones provided in a single large binary, or a Split package which contains individual binary files for each phone model’s specific software version.

• Browse to the Polycom Voice Support website to locate the software package for a specific family of devices or go to to the Polycom UCS/SIP Software Matrix website and download the desired release package. (Note that the newly qualified Lync software release of 4.1 is currently only available through your Polycom reseller for some devices.)
• Read and accept the notice regarding the previously explained upgrade process requirements for older devices.
• Once the download is complete open the compressed file and look for the *.sip.ld files. These are the individual firmware files for each model of Polycom SIP phone. The table below indicates which firmware file is used by which device.

• Extract either all of the .sip.ld files or select only the files associated to the model of phones that will need to be updated. (There is no harm in selecting all firmware files other than the additional disk space that will be used on the web server to store unneeded files, which is under 400MB for all images with the current releases combined).
• In this example only the VVX500 and SpectraLink phones will be updated, so the following files were extracted to an empty folder named firmware.

• In the same directory create a new text file called ucs.xml and then open it with a text editor. Copy the text below and paste it into the blank file (or just download this template file and rename it to ucs.xml).

<?xml version='1.0' encoding='utf-8' standalone='yes'?>
<PHONE_IMAGES>
<REVISION ID='>
<PHONE_IMAGE>
<VERSION>0.0.0</VERSION>
<PATH>http://webserver.domain.com/folder/</PATH>
</PHONE_IMAGE>
</REVISION>
</PHONE_IMAGES>

• Now edit the ucs.xml document with a text editor (or with an XML editor like Microsoft’s XML Notepad 2007 as it is easier to create and edit the files this way).
• Change the VERSION value from 0.0.0 to the version which matches the .sip.ld files which were previously downloaded in the same directory (e.g. 4.1.0.73405). To identify the exact version number open the sip.ver file included in the software download package. (The version number does not have to match exactly and it only used as a ‘display name’ when the phone accesses the files. When providing more than one software version this field is used to help identify which package the user should select.)

<VERSION>4.1.0.73405</VERSION>

• Change the PATH value from the example URL to the URL where the files will be uploaded to (e.g. http://www.schertz.local/firmware). This path must point directly to where the binary files are stored so the phone can access them. (If desired the XML file and binary files can be stored in different folders or location, but for simplicity the files will be stored in the same location in this example.)

<PATH>http://www.schertz.local/firmware/</PATH>

• Upload the selected binary files and the XML configuration file to the selected web server directory.

• Test the configuration by accessing the ucs.xml file on the web server directly from a web browser.

• Access the web UI of the phone and from the Utilities menu select Software Upgrade.
• Select Custom Server for the Server Type and enter the entire URL to the custom XML configuration file.

• Click the Check for Updates button and if the phone is able to successfully locate and access the XML file then the configured software download should be displayed as a choice for installation.

Netgear Router Firmware Upgrade

• Select the desired software version and then click the Install button to begin the process. The remainder of this process is identical to what is described earlier in the article.