Turret

Configure secure connections usage on turrets is made through the Web Admin / Web Wizard

FTPS

FTP server setup is made through Installation wizard. FTPS usage requires to reference the FTP server with a domain name instead of an IP Address. Web Administration console as well as Web Wizard allow to do so. If device network configuration relies on DHCP and a DHCP option has been setup to provide FTP server domain name, FTP setup can be done by selecting the proper option.

HTTPS

As mentioned in Advanced configuration topic, enabling "Use HTTPS for communications" makes turrets to access TSS though HTTPS instead of non secure HTTP.

Prevent USB port usage

From a security point of view, USB mass storage devices (such as USB memory stick or external USB hard drive) represent a thread. Turrets can be configured to disable such devices . To do so, start the device in Super User Mode, click on "Turret Settings" and, under Security tab, check the "Disable USB storages devices" option. Once done, click the reboot button on the Super User Mode screen to validate the configuration.

TLS communication

This security feature allows Turret to establish TLS communication.

Configure following settings in TSS management console, Turret Boot Settings or in the Cluster.

•Enable SIPS

application.protocol.sips.enable = true

Location: Terminal Boot Settings, TPO Shared Settings, TPO Private Settings, TPO Boot Settings
SIP	Enable TLS protocol truefalse Key: application.protocol.sips.enable Description: This parameter allows to enable TLS protocol in the SIP signalling (SIPS)

•Enable SRTP

profile.setting.protocol.srtp.enable = true

Location: Terminal Boot Settings, Terminal Profile Settings, boot
RTP	Enable SRTP protocol truefalse Key: profile.setting.protocol.srtp.enable Description: This parameter allows the turret to handle SRTP for voice stream and also in SIP SDP signalling. It is automatically enabled when Skype for Business compatibility is set.

Additional configuration:

•TLS connection port

application.sip.tlsconnection.port=5061 

Location: Terminal Boot Settings, TPO Shared Settings, TPO Private Settings, TPO Boot Settings
SIP	SIP Local TLS Ports Key: application.sip.tlsconnection.port Description: Defines list of ports dedicated to SIP TLS connections Port are separated by commas: 5061,5062 Defining several ports allows system to register extensions using only one IP address but different ports. TLS is used for Skype for Business. Care should be taken on the TPO VM that "Yes" is not selected on the Network discovery popup as this will use port 5357 causing a potential clash. Constraint: Any valid port number Mind that except in CUCM mode on TPO, all ports defined in application.sip.connection.port can't be as well defined in application.sip.tls connection.port. During a CUCM Devices Fetch, both keys application.sip.connection.port and application.sip.tls connection.port are automatically filled for the TPO. The TPO will use right ports depending of the secure/non secure configuration. The ports defined in this setting cannot be used by another application running on the same host. Related settings: SIP Local IP Ports (application.sip.connection.port) WebSocket Local Listening Ports (application.sip.websocket.listening.port) WebSocket Secure Local Listening Ports (application.sip.websocketsecure.listening.port)