Zero Touch Provisioning (Redirect Server)
A factory-default device that does not receive DHCP Option 160 or DHCP Options 66/67 automatically contacts the AudioCodes Redirect Server. The device authenticates using its factory-installed client certificate, and the Redirect Server responds with an HTTP 302 redirect to the provisioning URL associated with the device's MAC address.
The provisioning URL returned by the Redirect Server is not necessarily an AudioCodes service. Customers can register their own provisioning services against device MAC addresses. As a result, the firewall destinations that must be permitted depend on who manages the device:
| ■ | Devices Managed by AudioCodes Live Platform |
For devices managed by AudioCodes Live Platform, the Redirect Server returns the tenant's Service Device URL. The device then connects to the corresponding Live Platform Device Manager service for provisioning and lifecycle management.
See Live Platform Device Manager for the required endpoints and firewall rules.
| ■ | Devices Managed by Customer Provisioning Services |
When a customer or partner operates its own provisioning service, the Redirect Server returns the URL of that service. In this scenario, the enterprise firewall must allow access to the endpoints published by the provisioning service provider.
Other than access to the AudioCodes Redirect Server itself, the AudioCodes-specific firewall requirements described in this document do not apply.
| ■ | AudioCodes Zoom Devices |
For AudioCodes Zoom devices, follow Zoom's firewall guidance: Zoom network firewall or proxy server settings
The Zero Touch Provisioning chain is as follows:
|
DHCP option 160 → DHCP option 66/67 → redirect.audiocodes.com → 302 → Provisioning Service URL |
|---|
The following table describes the redirect endpoints:
|
Endpoint |
Port |
Protocol |
Direction |
Purpose |
||||||
|---|---|---|---|---|---|---|---|---|---|---|
|
redirect.audiocodes.com |
443 |
HTTPS / TLS |
Outbound device → cloud |
ZTP discovery:
Firmware default: provisioning/redirect_server_url= https://redirect.audiocodes.com |
||||||
|
Customer / partner provisioning URL |
443 |
HTTPS |
Outbound device → provisioning service |
If the MAC is registered to a non-AudioCodes provisioning service, the Redirect Server returns an HTTP 302 redirect to that service instead of to an AudioCodes Service Device URL. In this scenario, the destination FQDN is defined by the provisioning service provider, not by AudioCodes. The enterprise firewall must therefore allow access to the endpoints published by that service. The only AudioCodes-specific requirement is access to the Redirect Server itself; additional AudioCodes provisioning endpoints do not apply. AudioCodes Zoom devices: Follow Zoom's published network and firewall requirements, as referenced above. |
||||||
|
redirectapp.audiocodes.com |
443 |
HTTPS |
Outbound admin browser |
Redirect Service management portal, used to register MAC addresses to a tenant. Needed by administrators, not by devices. |