Cisco IP Phone 8800 Series Administration Guide for Cisco Unified Communications Manager - Technical Details [Cisco IP Phone 8865] (2024)

The following table shows the physical and operating environment specifications for the Cisco IP Phone 8800 Series.

Cisco IP Phone 8800 Series support several industry-standard and Cisco network protocols required for voice communication. The following table provides an overview of the network protocols that the phones support.

For more information about LLDP-MED support, see the LLDP-MED and Cisco Discovery Protocol white paper:

http://www.cisco.com/en/US/tech/tk652/tk701/technologies_white_paper0900aecd804cd46d.shtml

The Cisco IP Phone contains an internal Ethernet switch, enabling forwarding of packets to the phone, and to the computer (access) port and the network port on the back of the phone.

If a computer is connected to the computer (access) port, the computer and the phone share the same physical link to the switch and share the same port on the switch. This shared physical link has the following implications for the VLAN configuration on the network:

• The current VLANs might be configured on an IP subnet basis. However, additional IP addresses might not be available to assign the phone to the same subnet as other devices that connect to the same port.

• Data traffic present on the VLAN supporting phones might reduce the quality of VoIP traffic.

• Network security may indicate a need to isolate the VLAN voice traffic from the VLAN data traffic.

You can resolve these issues by isolating the voice traffic onto a separate VLAN. The switch port to which the phone connects would be configured for separate VLANs for carrying:

• Voice traffic to and from the IP phone (auxiliary VLAN on the Cisco Catalyst 6000 series, for example)

• Data traffic to and from the PC that connects to the switch through the computer (access) port of the IP phone (native VLAN)

Isolating the phones on a separate, auxiliary VLAN increases the quality of the voice traffic and allows a large number of phones to be added to an existing network that does not have enough IP addresses for each phone.

For more information, see the documentation that is included with a Cisco switch. You can also access switch information at this URL:

http://cisco.com/en/US/products/hw/switches/index.html

When connecting to the VoIP network, the Cisco IP Phones goes through a standard startup process. Depending on your specific network configuration, only some of these steps may occur on your Cisco IP Phone.

1. Obtain power from the switch. If a phone is not using external power, the switch provides inline power through the Ethernet cable that is attached to the phone.

2. (For the Cisco IP Phone 8861 and 8865 in a wireless LAN only) Scan for an access point. The Cisco IP Phone 8861 and 8865 scans the RF coverage area with the radio. The phone searches the network profiles and scans for access points that contain a matching SSID and authentication type. The phone associates with the access point with the highest RSSI that matches with the network profile.

3. (For the Cisco IP Phone 8861 and 8865 in a wireless LAN only) Authenticate with the access point. The Cisco IP Phone begins the authentication process. The following table describes the authentication process:

   Authentication type	Key management options	Description
   Open	None	Any device can authenticate to the access point. For added security, static WEP encryption might optionally be used.
   Shared Key	None	The phone encrypts the challenge text by using the WEP key and the access point must verify the WEP key that was used to encrypt the challenge text before network access is available.
   PEAP or EAP-FAST	None	The RADIUS server authenticates the username and password before network access is available.

4. Load the stored phone image. At startup, the phone runs a bootstrap loader that loads a phone firmware image that is stored in flash memory. Using this image, the phone initializes the software and hardware.

5. Configure the VLAN. If the Cisco IP Phone is connected to a Cisco Catalyst switch, the switch next informs the phone of the voice VLAN that is defined on the switch. The phone needs to know the VLAN membership before it can proceed with the Dynamic Host Configuration Protocol (DHCP) request for an IP address.

6. Obtain an IP address. If the Cisco IP Phone is using DHCP to obtain an IP address, the phone queries the DHCP server to obtain one. If you are not using DHCP in your network, you must assign static IP addresses to each phone locally.

7. Request the CTL file. The TFTP server stores the CTL file. This file contains the certificates that are necessary for establishing a secure connection between the phone and Cisco Unified Communications Manager.

   For more information, the documentation for your particular Cisco Unified Communications Manager release.

8. Request the ITL file. The phone requests the ITL file after it requests the CTL file. The ITL file contains the certificates of the entities that the phone can trust. The certificates are used to authenticate a secure connection with the servers or to authenticate a digital signature signed by the servers. Cisco Unified Communications Manager 8.5 and later supports the ITL file.

9. Access a TFTP server. In addition to assigning an IP address, the DHCP server directs the Cisco IP Phone to a TFTP Server. If the phone has a statically defined IP address, you must configure the TFTP server locally on the phone; the phone then contacts the TFTP server directly.

   Note	You can also assign an alternate TFTP server to use instead of the one that DHCP assigns.

10. Request the configuration file. The TFTP server has configuration files, which define parameters for connecting to Cisco Unified Communications Manager and other information for the phone.

11. Contact Cisco Unified Communications Manager. The configuration file defines how the Cisco IP Phone communicates with Cisco Unified Communications Manager and provides a phone with the load ID. After it obtains the file from the TFTP server, the phone attempts to make a connection to the highest priority Cisco Unified Communications Manager on the list.

    If the security profile of the phone is configured for secure signaling (encrypted or authenticated) and the Cisco Unified Communications Manager is set to secure mode, the phone makes a TLS connection. Otherwise, the phone makes a nonsecure TCP connection.

    If the phone was manually added to the database, Cisco Unified Communications Manager identifies the phone. If the phone was not manually added to the database and autoregistration is enabled in Cisco Unified Communications Manager, the phone attempts to autoregister itself in the Cisco Unified Communications Manager database.

    Note	Autoregistration is disabled when you configure the CTL client. In this case, you must add the phone to the Cisco Unified Communications Manager database manually.

The Cisco IP Phones 8851, 8851NR, 8861, 8865, and 8865NR support a maximum of five devices that connect to each USB port. Each device that connects to the phone is included in the maximum device count. For example, your phone can support five USB devices on the side port and five more standard USB devices on the back port. Many third-party USB products count as multiple USB devices; for example, a device containing a USB hub and headset can count as two USB devices. For more information, see the USB device documentation.

Note	Unpowered hubs are not supported, and powered hubs with more than four ports are not supported. USB headsets that connect to the phone through a USB hub are not supported.

Each key expansion module connects to the phone counts as a USB device. If three key expansion modules are connected to the phone, these count as three USB devices.

Anything that degrades network performance can affect phone audio and video quality, and in some cases, can cause a call to drop. Sources of network degradation can include, but are not limited to, the following activities:

• Administrative tasks, such as an internal port scan or security scan.

• Attacks that occur on your network, such as a Denial of Service attack.

The Cisco IP Phone 8800 Series uses a firewall to provide protection against cyber intrusions, such as a man-in-the-middle attack. This firewall cannot be disabled. But it could stop traffic on a phone, if you configure your network with two network routers in the same subnet and with IP redirect.

The phone firewall stops traffic because this network setup is similar to a man-in-the-middle attack. The phone receives redirect packets for different destination IPs in a different subnet from the phone. The phone is on a network with more than one router, and the default router sends traffic to a second router.

sip_tcp_create_connection: socket connect failed cpr_errno: 1.

A network with two network routers in the same subnet and with IP redirect is not a common configuration. If you are using this network setup, consider using only one router on a subnet. But if you require two network routers on the same subnet, disable IP Redirect on the router and reboot the phone.

Cisco supports phone API utilization by 3rd party applications that have been tested and certified through Cisco by the 3rd party application developer. Any phone issues related to uncertified application interaction must be addressed by the 3rd party and will not be addressed by Cisco.

For support model of Cisco certified 3rd party applications/solutions, please refer to Cisco Solution Partner Program website for details.