===============================================================================
UNIFY OPENSTAGE 40 SIP TO ASTERISK INTEGRATION RUNBOOK
===============================================================================
Document Purpose: Active ledger tracking steps, configurations, and procedures 
used to deploy a used Unify OpenStage 40 SIP handset onto an Asterisk IP-PBX.

Current Status: Production Ready / Final Security Hardening Complete.
===============================================================================

-------------------------------------------------------------------------------
PHASE 1: HARDWARE RESET & INITIALIZATION (COMPLETED)
-------------------------------------------------------------------------------
When taking over a used or decommissioned OpenStage 40 handset, the default
admin credentials ('123456') are frequently changed or lost. To clear legacy
deployment artifacts, VLANS, or stale SIP profiles, a hardware override reset
must be performed.

*Note: Holding down the '3' key during boot triggers the Netboot / TFTP recovery 
engine and should be avoided for standard operational resets.*

Execution Procedure:
  1. Allow the telephone to completely boot up to its native idle or error screen.
  2. Press and hold the '2', '8', and '9' keys simultaneously on the physical
     keypad for approximately 5 seconds.
  3. When prompted on the screen for the master override passcode, input:
     --> 124816
  4. Press the 'OK' checkmark button to confirm.
  
Result:
  - Phone formats configuration memory partitions.
  - Reboots automatically (takes ~2-3 minutes).
  - Restores management credentials to factory default ('admin' / '123456').

-------------------------------------------------------------------------------
PHASE 2: DEPLOYMENT BYPASS & WEB MANAGEMENT ACCESS (COMPLETED)
-------------------------------------------------------------------------------
1. Bypass the Initialization Wizard:
   - On the 'Deployment PIN' prompt screen, enter the Unify default bypass PIN:
     --> 40001998
   - Press 'OK' to reach the native unconfigured idle state.

2. Web-Based Management (WBM) Connection:
   - The phone requests an IP via DHCP automatically.
   - Access the web client by explicitly forcing HTTPS in the URL string:
     --> https://
   - Authenticate with the default credentials: admin / 123456

-------------------------------------------------------------------------------
PHASE 3: CORE NETWORK & DOMAIN ENVIRONMENT (UPDATED)
-------------------------------------------------------------------------------
The structural IP layer configuration matching the verified local network top-level
parameters:

(Path: Administrator Pages -> Network -> General IP configuration)
  - Protocol Mode:          IPv4_IPv6
  - LLDP-MED Enabled:       Enabled (Checked)
  - DHCP Enabled:           Enabled (Checked)
  - DHCPv6 Enabled:         Enabled (Checked)
  - DNS domain:             SIP-Phone
  - Primary DNS (IPv6):     fd84:abbf:4daa::1
  - Secondary DNS (IPv4):   9.9.9.9

-------------------------------------------------------------------------------
PHASE 4: SYSTEM IDENTITY & SIP REGISTRATION (COMPLETED)
-------------------------------------------------------------------------------
The network parameters and identity layouts applied to match the Asterisk 
server environment:

1. System Identification:
   (Path: Administrator Pages -> System -> System Identity)
   - Terminal number:       106
   - Terminal name:         Daniel OE3NDC
   - Display identity:      Daniel OE3NDC

2. SIP Registration Settings:
   (Path: Administrator Pages -> System -> Registration)
   - SIP server address:     10.66.1.66
   - SIP registrar address:  10.66.1.66
   - SIP gateway address:    10.66.1.66
   - Server type:           OS Voice
   - User ID:               106
   - Password:              \[SIP Endpoint Secret Token\]

-------------------------------------------------------------------------------
PHASE 5: CUSTOM LOGO PROVISIONING VIA FTP (COMPLETED)
-------------------------------------------------------------------------------
The phone firmware natively parses a custom corporate background image when 
formatted as a strict monochrome .bmp container. Due to web client parsing 
restrictions, deployment must be executed using a temporary local FTP server environment.

1. Local FTP Server Setup (Linux Server):
   - Install a lightweight Python-based FTP daemon:
     --> sudo apt install python3-pyftpdlib
   - Create an isolated deployment folder:
     --> mkdir phone_provisioning
   - Transfer your tailored 'ndc.bmp' image file into this directory.
   - Launch the anonymous FTP instance bound natively within that directory:
     --> cd phone_provisioning && python3 -m pyftpdlib

2. Phone WBM Profile Injection Settings:
   (Path: Administrator Pages -> File transfer -> Logo)
   - Use defaults:          Unchecked (Blank)
   - Download method:       FTP
   - FTP Server address:    10.66.1.10
   - FTP Server port:       2121
   - FTP account:           \[Blank\]
   - FTP username:          anonymous
   - FTP password:          \[Blank\]
   - FTP path:              \[Blank\]
   - HTTPS base URL:        \[Blank\]
   - Filename:              ndc.bmp
   - After submit:          start download

3. Transfer Verification:
   - Click "Submit" to commit configurations and trigger the execution process.
   - Status output will display: "Transfer completed successfully".

-------------------------------------------------------------------------------
PHASE 6: REGIONAL PREFERENCES & LOCALIZATION (UPDATED)
-------------------------------------------------------------------------------
Regional localized profiles configured explicitly to match regional target infrastructure:

1. Locality Profile Settings:
   (Path: User Pages -> Configuration -> Locality)
   - Country:               Österreich
   - Language:              Deutsch
   - Date format:           dd.mm.yy
   - Time format:           24 hour

2. Time & Date Sync Optimization:
   (Path: Administrator Pages -> Date and time)
   - SNTP IP address:       194.25.134.196
   - Timezone offset (hrs): +1
   - Daylight saving:       Enabled (Checked)
   - Difference (minutes):  60
   - Auto time change:      Enabled (Checked)
   - DST zone:              Europe (Rest)

-------------------------------------------------------------------------------
PHASE 7: MEDIA OPTIMIZATION & AUDIO HANDSHAKING (COMPLETED)
-------------------------------------------------------------------------------
Fine-tuning settings implemented to optimize call audio quality:

(Path: Administrator Pages -> Speech -> Codec preferences)
  - Allow "HD" icon:       Enabled (Checked)
  - Codec Ranking Priority Hierarchy:
    1st Priority: G.722 (Wideband HD Audio)
    2nd Priority: G.711 (Standard Narrowband)
    3rd Priority: G.729 (Low-Bandwidth Compressed)

-------------------------------------------------------------------------------
PHASE 8: SECURITY HARDENING & PASSWORD REVISION (UPDATED)
-------------------------------------------------------------------------------
To secure the handset and protect the web engine layout from unauthorized modification, 
the factory default credentials must be replaced immediately following successful registration.

(Path: Administrator Pages -> Security and Policies -> Password)

1. Change Administrator Password:
   - Click option: Change Admin password
   - Provide the default password ('123456') and input a unique, secure string.
   - Click "Submit" to lock down the admin interface.

2. Change User Interface Password:
   - Click option: Change User password
   - Define a custom numerical credential sequence to restrict access to local phone settings.
   - Click "Submit" to save changes.

-------------------------------------------------------------------------------
PHASE 9: REGISTRATION STATUS (VERIFIED)
-------------------------------------------------------------------------------
- Handset successfully establishes persistent state validation.
- Asterisk PJSIP/SIP endpoints show Extension 106 as fully registered, available, 
  and ready to route bidirectional VoIP streams.
===============================================================================
\[END OF RUNBOOK LOG - FINAL PRODUCTION REVISION COMPLETE\]
===============================================================================