Versions Compared

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.
Comment: Migration of unmigrated content due to installation of a new plugin

1.1.1 Accounts Management

Once you have almost one group you can fulfill it with SIP Accounts. In the Group List (PSOM 1.0 Groups) click on the Accounts icon on the right of each group's row. 

...

Send Installation Sms is good for sending via Text message a link meant to be used to download and thus install the

Brand
brandclient
application. More about the Automatic Activation and about the Provisioning can be read in paragraph 1.1.4.

Info

The customer's platform is automatically detected.

...

Each one is going to be detailed in the next paragraphs.

1.1.1.1 Create a new account, the plain way (manual configuration)

The "plain way" is a completely manual creation of the account. In this way you control any feature of the account, but you also need to configure the user's client manually. This way is the opposite of the automatic activation.

...

You can create both PGSM (

Brand
brandclient
) or SNOM accounts and they do differ a while.

1.1.1.1.1 PGSM

Subtitle
Prefixfigure
SubtitleTextSip Account creation form
AnchorNameaccount creation form

...

  • Username

  • Password/Repeat Password

  • Virtual Phone Number

  • Account Type

  • Security Model

  • Obfuscation Mode

  • Obfuscation Key

  • Keep-alive Enabled

Username/Password

Username field is automatically generated as a random numeric value and you are not required to change it. Type in a password and repeat it in the proper fields.

Warning

If you manually edit Username field, keep in mind that it MUST be unique, as Virtual Phone Number!

Virtual Phone Number

Set a Virtual Phone number as a numeric value of your choice. Please consider that the Virtual Phone Number is the number to be dialed to call the Account (and also the number shown as the caller, when the Account dials a call). We suggest a three character number such as "111" or "123" for SNOM devices and actual mobile phone number for

Brand
brandclient
accounts.

...

Note

It's still possible to perform an Automatic Activation or to send the installation URL on iPads or devices without phone features using the Provisioning Messages.

Account Type
  • To configure a

    Brand
    brandclient
    account select "PGSM" by the drop down menu in "Account Type".

  • To configure a SNOM account select "SNOM" by the drop down menu in "Account Type".

Security Models

...

Brand
brandclient

 

...

...

brandclient

 

...

Obfuscation Mode

The Obfuscation mode is a simple but quite efficient trick to let the VoIP pass without being recognized by network equipment intended to block or censor VoIP traffic.

It's not known to be a perfect mask and it aims not to be one, still it works fine up to now and our suggestion is to keep it enabled as by default,

Obfuscation Key

The key used by the obfuscator can be an arbitrary one, still "9" is the default value. It doesn't matter which number you put in here as long as it is the very same one you set up on the client side.

...

Xrefanchor
AnchorNamePSOM_keep_alive
Keep-alive Enabled

In order to receive secure phone calls,

Brand
brandclient
client must set up an always-on connection to
Brand
brandserver
. Each client sends a "keep alive" request to the server it is connected to, in order to keep up the socket. This is necessary as the TCP socket has an idle timeout after which the socket is closed. Some aggressive network equipment can shorten the standard timeout, less than 10 minutes. This behavior is particularly critical with IOS devices. 

...

Warning
titleolder clients issue

All the

Brand
brandclient
clients prior to the 11.1 version cannot respond to the keep-alive request and thus if such option was enabled for their users, then those users won't ever be on-line and reachable.

Virtual Phone Number (secondary)

This field is optional and rarely used, still it can prove itself quite useful if you need the account to be reachable by two different phone numbers on the same device. The secondary virtual number can't substitute the primary one, meaning that this field alone won't be accepted as a valid phone number. You still need to configure the primary phone number if you intend to make use of the secondary one.

Info

Some example for using the secondary phone number are this scenarios:

  1. User changes his own mobile phone number. Using secondary number it is possible to configure the NEW number as primary and the OLD number as secondary. The user will be able to receive secure calls dialed both on his NEW and OLD number.
  2. User install
    Brand
    brandclient
    client on his business phone, but his colleagues could call him both using business and private phone numbers.
    Using secondary number it is possible to configure the BUSINESS number as primary and the PRIVATE number as secondary. The user will be able to receive secure calls dialed both on his BUSINESS and PRIVATE number. More often that you could expect, users initiate secure calls using the wrong number, complaining about "it does not work".

1.1.1.1.2 SNOM

In the Account List page (

Xref
AnchorNamesip users table
) you can see an empty list of accounts. To create a new Sip User you have to click on the New Account button in the top of the page.

Subtitle
Prefixfigure
SubtitleTextSip SNOM Account creation form
AnchorNameaccount creation form SNOM

Image Modified

There are some few but still important differences between the 

Xref
AnchorNameaccount creation form SNOM
 and the 
Xref
AnchorNameaccount creation form
: security model, obfuscation Mode and Obfuscation Key fields are gone and instead you can read Deny and Permit. Due to the type of hardware underlying the SNOM account, we do assume that the hardware would be wired connected on a desktop. Also no obfuscation is possible because the device doesn't allow it. Instead the wired channel can provide us an easy to go access list, based on the LAN IP addresses. We can create both one White-List and one Black-List in order to bind the user's access to one specific device which can be identified by the LAN IP address. The different option shown are:

  • Deny
  • Permit 
Deny

Deny represent the blacklist based on the IP address and the net mask we want to deny when associated to the current user. You have to write this in the form: <ipaddress>/<network mask>

Examples:
  • 192.168.0.38/255.255.255.255 : Denies traffic from this IP address
  • 0.0.0.0/0.0.0.0 : Denies every address
Permit

Permit is the exact opposite of the Deny option. It represent the whitelist based on the IP address and the net mask we want to have access. You have to write this in the form: <ipaddress>/<network mask>

Example:
  • 192.168.0.38/255.255.255.0 : Allows traffic from this Network
Tip
titleEXAMPLE

You may have multiple rules for masking traffic. Combining together the Deny and the Permit option let you have a fine grain rule of access for any single user's account.

Please keep in mind that the access rules are processed from the first to the last, meaning that the Deny will be used first and then will be analysed the Permit one.

So:

  Deny: 0.0.0.0/0.0.0.0

  Permit: 216.27.242.66/255.255.255.255

 Deny every address except for the only one allowed.

1.1.1.1.3 Actually create the Account

After you filled in the form (either the PGSM or the SNOM one), please click on the Create icon at the page's bottom. 

...

To use the automatic activation even in the plain way go reading the 1.1.4 Automatic Activation.

1.1.1.2 Create a new account, the wizard way (automatic activation)

The "wizard way" is the new method for creating accounts. It's made for easing the load on the service manager's shoulder, letting him/her focusing on the service configuration without having to bother about the installation and configuration of the client.

...

Subtitle
Prefixfigure
SubtitleTextnew account by wizard
AnchorNamenew account by wizard

Image Modified

 

You'll see the "Edit Account page" with a precompiled, non-editable username  as in 

Xref
AnchorNamenew account by wizard
.

...

Warning

In the "wizard way" the user's account are DISABLED until the automatic activation is performed!

1.1.1.3 Create a new account, the batch way

The "batch way" is an account creation mode designed specifically for large number of users to be created quickly.

...

Subtitle
Prefixfigure
SubtitleTextcreate batch account
AnchorNamecreate batch account

Image Modified

Prepare a .csv file with some account. The file must be formatted as the example below, keeping header names in the first row

Code Block
languagenone
titlebatch users csv
fullName,gsmNumber,email,securityModel,description Alessandro Bergamaschi,+391234567890,alessandro.bergamaschi@privatewavebergamaschi@acme.com,end-to-site,Personal account Luigi Rossi,+3932456753,luigi.rossi@privatewaverossi@acme.com,end-to-site,Personal account Marco Bianchi,+39432242342,mbianchi@gmail.com,end-to-site,Personal account Mario Colombo,+394325346546,colombo.mario@privatewavemario@acme.com,end-to-site,Personal account

...

Once you've done you can choose whether to manually activate the user or to lean on the automatic activation.

 

Anchor
account_details
account_details
1.1.1.4 Account's details

The figure 

Xref
AnchorNamenew sip account
 shows the last step of the procedure for account creation, but it's the same view you can get clicking on the Details link in the first column of the account's list (as in 
Xref
AnchorNamesip users table

...

From this summary of the account's configurations you can manage the account itself. It's possible to Send Installation Sms or to Send Activation Sms, action which we explore deeper in paragraph 1.1.4, as well as to Disable account. The last action inhibits the user to call or to be called and a specific Audio Message is issued by the

Brand
brandserver
to inform the user.

It's also possible to Edit the account's settings (more about this in the paragraph 1.1.2), Refresh account's data (which is proved to be quite useful to monitor the Text Messages status, like the Installation clicked) or simply Delete (paragraph 1.1.3) the account itself. In the following paragraphs you'll read more about account's management.

Anchor
account_update
account_update
1.1.2 Update the 
Account

To change the SIP Account values you need to reach the form showed in

Xref
AnchorNameshow_account_configuration
, which has been explained in the paragraph 1.1.1.4. Once there, you can just press the Edit button at the bottom.

...

As shown in 

Xref
AnchorNameaccount_updated
 the Web Console would warn you after the updated was processed. You can check the changes clicking on the Configuration tab.

Anchor
account_delete
account_delete
1.1.3 Delete the Account

In order to delete the account you have to access at the account details as described in paragraph 1.1.1.4. You have to get the Configuration details as in 

Xref
AnchorNameshow_account_configuration
. At the bottom of the details window you can see a Delete button that's what you're looking for.

...

Once you're done, by pressing the "Ok" button, the Account List page will be shown up without the Account and with a warning: see 

Xref
AnchorNameaccount deleted

Anchor
automatic_activation
automatic_activation
1.1.4 Automatic Activation of the Account

 After you created your new account(s) you have to configure the customer's client application

Brand
brandclient
. In the wizard way it's MANDATORY to use the automatic activation in order to enable the account. In the plain way it's optional, though useful.

...

Subtitle
Prefixfigure
SubtitleTextinstallation sms sent
AnchorNameinstallation sms sent

Image Modified

Warning

The SMSs are sent to the account's Virtual Phone Number, so please check it exist as an actual mobile phone number before using the Automatic Activation

...

Tip

You can check if the customer is connected using the "Registered Account" menu.

Anchor
account_disable
account_disable
1.1.5 Disabling/Enabling an Account

If you need to temporary block any account in both directions so that he cannot place or receive calls, then you can just disable him. When a disabled account tries to perform secure voice actions a proper audio message is played warning about the account' status.

...

Just press it and it will change as in 

Xref
AnchorNameaccount_disabled
. In order to enable the Account again you just have to press the Enable account and check the link and the related icon are changed again to the default.

1.1.6 Searching an Account

You can search search a group's accounts with the search box on the menu bar of the Account list page.

Subtitle
Prefixfigure
SubtitleTextThe searching interface
AnchorNamesearching account
Image Modified

 

The search covers the following fields of accounts:

...

Info

The search engine is based on Apache Lucene; see "Query Parser Syntax" for a detailed description of the full syntax of search queries. The field names that can be used in search queries are owner, username, callerid, email and description.

Anchor
licencing
licencing
 1.1.7 Licensing

The communication model of the licence can change quite a bit based on how user activated his account. Manual account creation leads the licence client on

Brand
brandclient
to communicate directly with PrivateWave
Brand
brandcompany
's licence server. Automatic Activated clients would communicated with their own
Brand
brandserver
, which plays the role of a proxy to PrivateWave
Brand
brandcompany
's licence server. In the latter case, the current licence is cached on
Brand
brandserver
and visible in account details.

Info
titleexample given

Let's say we have a

Brand
brandserver
named test1.privatewaveacme.com. This
Brand
brandserver
sent an Automatic Activation text message to the client PGSM_A. PGSM_A would ask to test1.privatewaveacme.com for its licence validation.

If it was a manual configured account, then it would ask its licence validation to the main licence server.

Since the licence validation is an important component of the secure call, it's important that this difference in the behaviour of the client is fully understood by the Operator Manager. For instance if the Services weren't configured to let the HTTPS/SmartPhone Web Service be reachable on the public NIC, then the licence clients of any Automatically Activated

Brand
brandclient
s would never be able to validate their own licences and thus the client would be stuck until its licence status would be cleared somehow.

...