SCOPLINK UPA Activation Requirements and Configuration

1. Purpose

This document describes the technical requirements and configuration settings required to activate the SCOPLINK UPA collaboration application on a SCOPTEL platform.

SCOPLINK UPA relies on PJSIP, WebRTC, DTLS, and the HTTP and HTTPS services of the telephony module. All requirements described below must be configured before deploying the application to users.

2. System Requirements

The platform must meet the following minimum requirements:

Before proceeding, verify that the system is up to date and that the installed API versions meet or exceed these requirements.

3. Enable the PJSIP Protocol

The PJSIP protocol must be enabled on the SCOPTEL platform.

SCOPLINK UPA uses PJSIP to establish and manage telephony communications. A configuration using only the legacy SIP channel driver will not support the complete functionality of the application.

After enabling PJSIP, verify that the telephony services are running properly and that no related errors are present in the system logs.

4. API Requirements

API V3

The minimum required version of API V3 is:                   8.0.47

A more recent version may also be used.Event API

The minimum required version of the Event API is:        8.0.0.18

After installing or updating the Event API, ensure that its service is started and configured to start automatically when the server boots.

The Event API service must remain active so that SCOPLINK UPA can receive real-time telephony events, including extension status changes, incoming and outgoing calls, and other events associated with user extensions.

5. Firewall Configuration

In the SCOPTEL firewall configuration, access the following option:

VoIP — SIP/IAX/MGCP

Add or allow the following TCP ports:

Port 8089/TCP is especially important for secure WebRTC communications using WSS and DTLS.

The firewall rules must allow connections from the networks or IP addresses used by the workstations running SCOPLINK UPA.

When the application is used remotely, the perimeter firewall rules, NAT configuration, and security policies must also allow access to these ports.

6. Extension Configuration

For each extension that will use SCOPLINK UPA:

1. Open the extension configuration.
   
2. Enable the WebRTC option.
3. Enable the DTLS Encryption option.
   
4. Enable Use received media transport.
   
5. Enable AVPF
6. Save the changes.
7. Apply or reload the telephony configuration.
   

WebRTC

The WebRTC option allows the application to establish audio communications directly through its interface using a WebSocket connection.

DTLS Encryption

The DTLS Encryption option enables the encryption required to secure WebRTC communications and media negotiation.

Both options must be enabled for every extension used with SCOPLINK UPA.

7. Enable HTTP and HTTPS Services

In the SCOPTEL administration interface:

1. Open the Telephony Module tab.
2. Locate the HTTP server settings.
3. Enable the HTTP Server option.
4. Enable the HTTPS option.
5. Save the changes.
6. Restart or reload the applicable services when required.

The HTTP server allows Asterisk and SCOPLINK UPA to use the WebSocket connections required for WebRTC.

HTTPS is strongly recommended and is generally required for secure WebRTC connections.

8. Service Validation

Before activating user accounts, verify the following:

• Rocky Linux 8 is installed.
• PJSIP is enabled and operational.
• API V3 is version 8.0.47 or later.
• The Event API is version 8.0.0.18 or later.
• The Event API service is running.
• The Event API service starts automatically when the server boots.
• TCP ports 8088 and 8089 are allowed through the firewall.
• WebRTC is enabled on the extensions.
• DTLS Encryption is enabled on the extensions.
• HTTP Server is enabled in the Telephony Module.
  
• HTTPS is enabled.
  

  
  

  • Verify the http service on Asterisk (asterisk -vr)
    http show status
  • From the PBX, check that the HTTPS port is listening: ss -ltnp | grep -E ':8088|:8089'
    
  • From an external system, verify that TCP 8089 is reachable: nc -vz your-public-hostname 8089
    
  • You can also inspect the TLS certificate:

    openssl s_client -connect 127.0.0.1:8089 \
    -servername your.public.hostname </dev/null

    Check that the certificate’s names include the hostname used by the client:

    wss://your.public.hostname:8089/ws

    A browser will reject WSS if the certificate is expired, untrusted, or issued for a different hostname.
    
    
    Test locally
    Run:

    curl -I http://127.0.0.1:8088/ws
    curl -k -I https://127.0.0.1:8089/ws

    Test from outside
    From a machine that is not on the PBX’s LAN:

    nc -vz your.public.hostname 8089

    Or:

    openssl s_client -connect your.public.hostname:8089 \
    -servername your.public.hostname

    TCP 8089 -> PBX TCP 8089

9. Recommended Tests

After completing the configuration, perform the following tests using a pilot extension:

1. Log in to SCOPLINK UPA.
2. Confirm that the PJSIP extension registers successfully.
3. Verify the presence and extension status.
4. Receive an incoming call.
5. Place an outgoing call.
6. Confirm two-way audio.
7. Test call hold and resume.
8. Test call transfer.
9. Confirm automatic reconnection after closing and reopening the application.
10. Test operation from an external network when remote access is required.

10. Important Considerations

An invalid, expired, or untrusted HTTPS certificate may prevent the secure WebSocket connection from being established.

Security devices located between the user and the server, including firewalls, routers, and traffic inspection systems, must not block WebSocket connections on TCP port 8089.

Changes to the PJSIP, WebRTC, DTLS, or HTTP server settings may require a configuration reload or a restart of the telephony services.

It is recommended to test SCOPLINK UPA with a single extension before enabling it for all users.

11. Configuration Summary

To activate SCOPLINK UPA, the platform must run Rocky Linux 8 with PJSIP enabled. API V3 must be version 8.0.47 or later, and the Event API must be version 8.0.0.18 or later, with its service running.

TCP ports 8088 and 8089 must be allowed in the firewall under VoIP — SIP/IAX/MGCP. WebRTC and DTLS Encryption must be enabled on each applicable extension. Finally, HTTP Server and HTTPS must be enabled under the Telephony Module tab.