ShoreTel and Third-Party Paging

I recently ran into an issue when I was installing a new ShoreTel Phone System. The customer failed to mention that they were expecting the ShoreTel System to be tied into their existing Valcom paging system (that's always awesome...). Here is what we did to get it working:

1. Log into ShoreWare Director in "Support Mode"
1. Hold down ctrl+shift and click on User Name. You will see "Support Entry" in red underneath the login area.
2. Create an Analog Loop-start Trunk and name it Paging. Although no fields are actually needed, it will require you to enter an access code and local area code in order to save it.
1. In my case, the Valcom Paging System was assigned an extension of 451 (unfortunately, getting this to work will require you to get some information from the customer. In other words, the extension number used by the paging system). We need to duplicate this extension number as an Off System Extension (451-451) at the bottom of the page.
2. Add the string ;1G;1I to the custom string field. The first three characters tell the system to wait 1 second after going off hook and presume a connection even if a dial tone is not heard. The second three characters tell the system not to outpulse the off system extension after the trunk is seized.
3. In director, navigate to the switch that has an open analog port on it that you will connect to the paging system. Set the type as trunk, and then add the Paging trunk that you created.

That's really it. For each user, I created a custom speed dial button that calls 451. Once they hit the custom button, they can then hit any number to send DTMF and it will beep, allowing the page to be made.

ShoreTel Reverse Proxy for Mobile Communicator

I recently ran into an issue when attempting to create a reverse proxy between the ShoreTel HQ server and the outside world. I thought I would share the steps I took to get this working.

Scenario: You have purchased the Mobile Access License which allows the utilization of the ShoreTel Mobile Communicator via a smart phone from the 3G/4G network. Now, in order for mobile access to work, ports 80, 5447, and 5449 need to be opened to allow authentication and traffic. Giving access to your ShoreTel server over port 80 from the outside world is never recommended, so building a proxy server to translate one random port to the three ports mentioned above is best practice.

Before you continue reading, download and read through the official ShoreTel Application Note#10370 found here.

Please use the steps in the application note to get everything set up. I followed this guide myself, but due to the document being outdated I had to make certain changes in order to get this working. These changes are as follows.

• Do not use port 5500 as specified in the application note. As of ShoreTel 12, port 5500 is in use by DTAS. Not sure why this would affect this scenario, but it did. Use any other random port, like 5505 for example.
• Change the web.config file to the following (additions in red):

<?xml version="1.0" encoding="UTF-8"?>

<configuration>

<system.webServer>

<rewrite>

<rules>

<rule name="ShoreTel Authenticate Redirect" stopProcessing="true">

<match url="^authenticate(.*)" />

<action type="Rewrite" url="http://shoretelhq.internal.name:80{R:1}" logRewrittenUrl="true" />

</rule>

<rule name="ShoreTel CAS Redirect" stopProcessing="true">

<match url="^cas(.*)" />

<action type="Rewrite" url="http://shoretelhq.internal.name:5447{R:1}" logRewrittenUrl="true" />

</rule>

<rule name="ShoreTel Director2 Redirect" stopProcessing="true">

<match url="^director2(.*)" />

<action type="Rewrite" url="http://shoretelhq.internal.name:5449{R:1}" logRewrittenUrl="true" />

</rule>

</rules>

<outboundRules>

<preConditions>

<preCondition name="IsHTML">

<add input="{RESPONSE_CONTENT_TYPE}" pattern="^text/html" />

</preCondition>

</preConditions>

</outboundRules>

</rewrite>

<urlCompression doStaticCompression="false" doDynamicCompression="false" />

</system.webServer>

</configuration>

• Restart IIS

This is all I did to get it working. All it took was a little google fu and a packet capture.

Adding SIP Extensions to ShoreTel

Recently I had an installation in which we needed to add multiple Polycom SoundPoint 501 phones to the ShoreTel Phone System. Since the guides that explain how to add SIP extensions are outdated and the process is completely manual, I thought I would share how we automated the process of adding these phones, making it almost as easy as adding ShorePhones to the system.

It is important to note that you need to ensure that you have the proper licensing. Also, please download and read the manual process of adding SIP extensions prior to attempting this automated process. Your partner of record will be able to provide you with multiple documents if you do not have access to the ShoreTel Knowledge Base.

1. The first thing you need to do is download and run some type of TFTP server program. We did it on the ShoreWare Server just to keep things simple.
2. Go to Polycom's site and download the version of SIP that it specifies to use in the ShoreTel KB for your phone model.
3. Place the downloaded files into the root directory of your TFTP server.
4. You don't really need to worry about anything that's in there other than the file titled, "000000000000.cfg." This file is the first file that the phone looks to in order to pull configuration information.
5. Edit the "000000000000.cfg" and add "[MACADDRESS]-user.cfg, CUSTOM_phone1.cfg, CUSTOM_sip.cfg" to the config files string for your specific SoundPoint model. You will see I added it to all models in the attached template.
6. Create two files called, "CUSTOM_phone1.cfg" and "CUSTOM_sip.cfg", and add the information as specified in the attached template files. These files essentially tells the phones how to connect to ShoreTel so you don't have to log into the GUI of each phone and enter parameters by hand.
7. Create one file for each of your SIP phones with each phone's MAC address in the title of each file name. So, if your phone's MAC address is AB:CD:EF:GH:IJ:KL, then create a file called "abcdefghijkl-user.cfg" and add the information as shown below in the "enterphonemac-user.cfg" file example. This file specifies extension number and SIP password information as specified in the Users->Individual Users page of the ShoreWare Director.
8. Optional step: Factory default the phone (Format File System, Reset Device Settings, and Reset Local Config).
9. Enter the IP address of the TFTP server and any other necessary information (i.e. VLAN ID) on the phone. These can also be achieved via custom DHCP options. I am not going to go over this process because it is different depending on what you are using for your DHCP server.
10. Reboot the phone and that’s that.

Here is a look at the files with information we added in red:

000000000000.cfg with Custom String:

<?xml version="1.0" encoding="utf-8" standalone="yes"?>

<!-- Default Master SIP Configuration File-->

<!-- For information on configuring Polycom VoIP phones please refer to the -->

<!-- Configuration File Management white paper available from: -->

<!-- http://www.polycom.com/common/documents/whitepapers/configuration_file_management_on_soundpoint_ip_phones.pdf -->

<!-- $RCSfile$  $Revision: 125118 $ -->

<APPLICATION APP_FILE_PATH="sip.ld" CONFIG_FILES="phone1.cfg, sip.cfg" MISC_FILES="" LOG_FILE_DIRECTORY="logs" OVERRIDES_DIRECTORY="" CONTACTS_DIRECTORY="" LICENSE_DIRECTORY="">

  <APPLICATION_SPIP300 APP_FILE_PATH_SPIP300="sip_212.ld" CONFIG_FILES_SPIP300="[MACADDRESS]-user.cfg, CUSTOM_phone1.cfg, CUSTOM_sip.cfg, phone1_212.cfg, sip_212.cfg" />

  <APPLICATION_SPIP301 APP_FILE_PATH_SPIP301="sip_318.ld" CONFIG_FILES_SPIP301="[MACADDRESS]-user.cfg, CUSTOM_phone1.cfg, CUSTOM_sip.cfg, phone1_318.cfg, sip_318.cfg" />

  <APPLICATION_SPIP430 APP_FILE_PATH_SPIP430="sip_318.ld" CONFIG_FILES_SPIP430="[MACADDRESS]-user.cfg, CUSTOM_phone1.cfg, CUSTOM_sip.cfg, phone1_318.cfg, sip_318.cfg" />

  <APPLICATION_SPIP500 APP_FILE_PATH_SPIP500="sip_212.ld" CONFIG_FILES_SPIP500="[MACADDRESS]-user.cfg, CUSTOM_phone1.cfg, CUSTOM_sip.cfg, phone1_318.cfg, sip_212.cfg" />

  <APPLICATION_SPIP501 APP_FILE_PATH_SPIP501="sip_318.ld" CONFIG_FILES_SPIP501="[MACADDRESS]-user.cfg, CUSTOM_phone1.cfg, CUSTOM_sip.cfg, phone1_318.cfg, sip_318.cfg" />

  <APPLICATION_SPIP600 APP_FILE_PATH_SPIP600="sip_318.ld" CONFIG_FILES_SPIP600="[MACADDRESS]-user.cfg, CUSTOM_phone1.cfg, CUSTOM_sip.cfg, phone1_318.cfg, sip_318.cfg" />

  <APPLICATION_SPIP601 APP_FILE_PATH_SPIP601="sip_318.ld" CONFIG_FILES_SPIP601="[MACADDRESS]-user.cfg, CUSTOM_phone1.cfg, CUSTOM_sip.cfg, phone1_318.cfg, sip_318.cfg" />

  <APPLICATION_SSIP4000 APP_FILE_PATH_SSIP4000="sip_318.ld" CONFIG_FILES_SSIP4000="[MACADDRESS]-user.cfg, CUSTOM_phone1.cfg, CUSTOM_sip.cfg, phone1_318.cfg, sip_318.cfg" />

</APPLICATION>

CUSTOM_phone1.cfg:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

<phone1>

   <reg reg.1.server.2.transport="DNSnaptr" reg.1.server.1.transport="DNSnaptr" reg.1.type="private" reg.1.server.1.address="Virtual_IP_of_SIP_Proxy" reg.1.server.1.port="5060"  reg.1.server.1.expires="3600" reg.1.server.1.register="1" reg.1.server.1.retryTimeOut="0" reg.1.server.1.retryMaxCount="3" />

  <msg msg.bypassInstantMessage="0">

    <mwi msg.mwi.1.callBack="1102" msg.mwi.1.callBackMode="contact" msg.mwi.1.subscribe="1102" divert.dnd.1.contact="1101" divert.dnd.1.enabled="1" />

  </msg>

</phone1>

CUSTOM_sip.cfg:

<?xml version="1.0" encoding="utf-8" standalone="yes"?>

<!-- SIP Application Configuration File -->

<!-- $RCSfile$  $Revision: 100041 $ -->

<sip>

  <voIpProt>

    <server voIpProt.server.1.address="Virtual_IP_of_SIP_Proxy" voIpProt.server.1.port="5060" voIpProt.server.1.transport="DNSnaptr" voIpProt.server.1.expires="3600" voIpProt.server.1.register="1" voIpProt.server.1.retryTimeOut="0" voIpProt.server.1.retryMaxCount="3" voIpProt.server.1.expires.lineSeize="30" />

  </voIpProt>

  <TCP_IP>

    <SNTP tcpIpApp.sntp.resyncPeriod="86400" tcpIpApp.sntp.address="SNTP_Server" tcpIpApp.sntp.address.overrideDHCP="1" tcpIpApp.sntp.gmtOffset="-28800" tcpIpApp.sntp.gmtOffset.overrideDHCP="1" />

  </TCP_IP>

 </sip>

enterphonemac_user.cfg:

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>

<phone1>

   <reg reg.1.label="enterextension" reg.1.auth.userId="enterextension" reg.1.auth.password="sip_password" reg.1.address="enterextension" reg.1.displayName="EnterUserName" />

</phone1>

Juniper Networks SRX Sample Configuration

Below is a sample remote site configuration of a Juniper SRX100 firewall along with explanations. I used this template configuration to deploy multiple firewalls in a multi-site, retail-type deployment. You will see 4 separate subnets/VLANs for voip, data, corporate wireless, and guest wireless. In this particular example, the VoIP deployment was ShoreTel, and the wireless technology used was that of Aruba Networks. You will also see a route-based VPN configuration bound to the untrust interface, allowing for communication between the HQ and remote site.

Note: You can view the configuration in the format below any time by issuing the command, "show | display set". I changed a bit of how it is displayed in order to better show what each line means.

To set the host name:

set system host-name

To set the root password:

set system root-authentication plain-text-password

To set the name server:

set system name-server

To set additional user names and passwords:

set system login user example uid 2000

set system login user example class super-user

set system login user example authentication plain-text-password 

To allow different global services:

set system services ftp

set system services ssh

set system services web-management https system-generated-certificate

set system services web-management https interface vlan.5 

(vlan.5 allows web management from that logical interface only. You will see below that vlan.5 is also known as the data vlan)

To set other system policies:

set system syslog archive size 100k

set system syslog archive files 3

set system syslog user * any emergency

set system syslog file messages any critical

set system syslog file messages authorization info

set system syslog file interactive-commands interactive-commands error

set system max-configurations-on-flash 5

set system max-configuration-rollbacks 5

set system license autoupdate url https://ae1.juniper.net/junos/key_retrieval

(The settings above are actually there by default, but can be changed as needed.)

To configure interfaces:

set interfaces fe-0/0/0 description "WAN"

set interfaces fe-0/0/0 unit 0 family inet dhcp

(In this example, I am using interface fe-0/0/0 as the WAN interface.)

set interfaces fe-0/0/1 description "VOIP/DATA"

set interfaces fe-0/0/1 unit 0 family ethernet-switching port-mode trunk

set interfaces fe-0/0/1 unit 0 family ethernet-switching native-vlan-id 5

(Interface fe-0/0/1 is a trunk port for both the VOIP and DATA VLANs.)

set interfaces fe-0/0/2 disable

set interfaces fe-0/0/3 disable

set interfaces fe-0/0/4 disable

set interfaces fe-0/0/5 disable

set interfaces fe-0/0/6 disable

(The interfaces above are disabled since they are not in use in this example.)

set interfaces fe-0/0/7 description "CORP WIRELESS/GUEST WIRELESS"

set interfaces fe-0/0/7 unit 0 family ethernet-switching port-mode trunk

set interfaces fe-0/0/7 unit 0 family ethernet-switching native-vlan-id 6

(Interface fe-0/0/7 is a trunk port for both the CORP WIRELESS and GUEST WIRELESS VLANs.)

To configure an interface for route-based VPN:

set interfaces st0 unit 0 family inet next-hop-tunnel 10.10.10.254 ipsec-vpn routebasedvpn

set interfaces st0 unit 0 family inet address 10.10.10.5/24

(The 10.10.10.254 IP is the address of the HQ st0 interface. The 10.10.10.5 IP is the address of the local st0 interface)

To configure a gateway/subnet for each VLAN:
set interfaces vlan unit 1 family inet address 192.168.4.1/24

set interfaces vlan unit 2 family inet address 192.168.5.1/24

set interfaces vlan unit 3 family inet address 192.168.6.1/24

set interfaces vlan unit 4 family inet address 192.168.7.1/24

To configure DHCP options:

set forwarding-options helpers bootp relay-agent-option

set forwarding-options helpers bootp description "DHCP SERVER"

set forwarding-options helpers bootp server 10.10.100.10

set forwarding-options helpers bootp vpn

set forwarding-options helpers bootp interface vlan.4

set forwarding-options helpers bootp interface vlan.5

set forwarding-options helpers bootp interface vlan.6

set forwarding-options helpers bootp interface vlan.7

(In the example above, the SRX is doing a relay from a centralized DHCP server at HQ.)

To configure routing options:
set routing-options static route 192.168.4.0/24 next-hop st0.0

(In the example above, the subnet for the VoIP VLAN is being routed over the VPN tunnel interface.)

To set protocols:
set protocols igmp interface vlan.4

set protocols lldp interface all

set protocols lldp-med interface all

To configure IPSEC VPN:

set security ike proposal phase1-prop authentication-method pre-shared-keys

set security ike proposal phase1-prop dh-group group2

set security ike proposal phase1-prop authentication-algorithm sha1

set security ike proposal phase1-prop encryption-algorithm 3des-cbc

set security ike policy ike-policy1 mode main

set security ike policy ike-policy1 proposal-set standard

set security ike policy ike-policy1 pre-shared-key ascii-text test1234

set security ike gateway ike-gateway1 ike-policy ike-policy1

set security ike gateway ike-gateway1 address 1.1.1.1

set security ike gateway ike-gateway1 external-interface fe-0/0/0.0

set security ipsec proposal phase2-prop protocol esp

set security ipsec proposal phase2-prop authentication-algorithm hmac-sha1-96

set security ipsec proposal phase2-prop encryption-algorithm 3des-cbc

set security ipsec policy ipsec-policy1 perfect-forward-secrecy keys group2

set security ipsec policy ipsec-policy1 proposal-set standard

set security ipsec vpn routebasedvpn bind-interface st0.0

set security ipsec vpn routebasedvpn ike gateway ike-gateway1

set security ipsec vpn routebasedvpn ike ipsec-policy ipsec-policy1

set security ipsec vpn routebasedvpn establish-tunnels immediately

To configure NAT:

set security nat source rule-set voip-to-untrust from zone voip

set security nat source rule-set voip-to-untrust to zone untrust

set security nat source rule-set voip-to-untrust rule source-nat-rule1 match source-address 192.168.4.0/24

set security nat source rule-set voip-to-untrust rule source-nat-rule1 then source-nat interface

set security nat source rule-set trust-to-untrust from zone trust

set security nat source rule-set trust-to-untrust to zone untrust

set security nat source rule-set trust-to-untrust rule source-nat-rule2 match source-address 192.168.5.0/24

set security nat source rule-set trust-to-untrust rule source-nat-rule2 then source-nat interface

set security nat source rule-set corp_wireless-to-untrust from zone corp_wireless

set security nat source rule-set corp_wireless-to-untrust to zone untrust

set security nat source rule-set corp_wireless-to-untrust rule source-nat-rule3 match source-address 192.168.6.0/24

set security nat source rule-set corp_wireless-to-untrust rule source-nat-rule3 then source-nat interface

set security nat source rule-set guest_wireless-to-untrust from zone guest_wireless

set security nat source rule-set guest_wireless-to-untrust to zone untrust

set security nat source rule-set guest_wireless-to-untrust rule source-nat-rule3 match source-address 181.168.7.0/24

set security nat source rule-set guest_wireless-to-untrust rule source-nat-rule3 then source-nat interface

To configure screen options:

set security screen ids-option untrust-screen icmp ping-death

set security screen ids-option untrust-screen ip source-route-option

set security screen ids-option untrust-screen ip tear-drop

set security screen ids-option untrust-screen tcp syn-flood alarm-threshold 1024

set security screen ids-option untrust-screen tcp syn-flood attack-threshold 200

set security screen ids-option untrust-screen tcp syn-flood source-threshold 1024

set security screen ids-option untrust-screen tcp syn-flood destination-threshold 2048

set security screen ids-option untrust-screen tcp syn-flood timeout 20

set security screen ids-option untrust-screen tcp land

To configure zones:

set security zones security-zone voip host-inbound-traffic system-services all

set security zones security-zone voip host-inbound-traffic protocols all

set security zones security-zone voip interfaces vlan.4
set security zones security-zone trust host-inbound-traffic system-services all

set security zones security-zone trust host-inbound-traffic protocols all

set security zones security-zone trust interfaces vlan.5

set security zones security-zone untrust screen untrust-screen

set security zones security-zone untrust interfaces fe-0/0/0.0 host-inbound-traffic system-services dhcp

set security zones security-zone untrust interfaces fe-0/0/0.0 host-inbound-traffic system-services ike

set security zones security-zone untrust interfaces fe-0/0/0.0 host-inbound-traffic protocols router-discovery

set security zones security-zone corp_wireless host-inbound-traffic system-services all

set security zones security-zone corp_wireless host-inbound-traffic protocols all

set security zones security-zone corp_wireless interfaces vlan.6

set security zones security-zone vpn address-book address hq_network 10.10.0.0/16

set security zones security-zone vpn interfaces st0.0 host-inbound-traffic system-services all

set security zones security-zone vpn interfaces st0.0 host-inbound-traffic protocols all

set security zones security-zone guest_wireless host-inbound-traffic system-services all

set security zones security-zone guest_wireless host-inbound-traffic protocols all

set security zones security-zone guest_wireless interfaces vlan.7

To configure policies from zone to zone:

set security policies from-zone trust to-zone untrust policy trust-to-untrust match source-address any

set security policies from-zone trust to-zone untrust policy trust-to-untrust match destination-address any

set security policies from-zone trust to-zone untrust policy trust-to-untrust match application any

set security policies from-zone trust to-zone untrust policy trust-to-untrust then permit

set security policies from-zone trust to-zone trust policy trust-to-trust match source-address any

set security policies from-zone trust to-zone trust policy trust-to-trust match destination-address any

set security policies from-zone trust to-zone trust policy trust-to-trust match application any

set security policies from-zone trust to-zone trust policy trust-to-trust then permit

set security policies from-zone trust to-zone vpn policy trust-to-vpn match source-address any

set security policies from-zone trust to-zone vpn policy trust-to-vpn match destination-address any

set security policies from-zone trust to-zone vpn policy trust-to-vpn match application any

set security policies from-zone trust to-zone vpn policy trust-to-vpn then permit

set security policies from-zone vpn to-zone trust policy vpn-to-trust match source-address any

set security policies from-zone vpn to-zone trust policy vpn-to-trust match destination-address any

set security policies from-zone vpn to-zone trust policy vpn-to-trust match application any

set security policies from-zone vpn to-zone trust policy vpn-to-trust then permit

set security policies from-zone corp_wireless to-zone untrust policy corp_wireless-to-untrust match source-address any

set security policies from-zone corp_wireless to-zone untrust policy corp_wireless-to-untrust match destination-address any

set security policies from-zone corp_wireless to-zone untrust policy corp_wireless-to-untrust match application any

set security policies from-zone corp_wireless to-zone untrust policy corp_wireless-to-untrust then permit

set security policies from-zone corp_wireless to-zone vpn policy corp_wireless-to-vpn match source-address any

set security policies from-zone corp_wireless to-zone vpn policy corp_wireless-to-vpn match destination-address any

set security policies from-zone corp_wireless to-zone vpn policy corp_wireless-to-vpn match application any

set security policies from-zone corp_wireless to-zone vpn policy corp_wireless-to-vpn then permit

set security policies from-zone corp_wireless to-zone corp_wireless policy corp_wireless-to-corp_wireless match source-address any

set security policies from-zone corp_wireless to-zone corp_wireless policy corp_wireless-to-corp_wireless match destination-address any

set security policies from-zone corp_wireless to-zone corp_wireless policy corp_wireless-to-corp_wireless match application any

set security policies from-zone corp_wireless to-zone corp_wireless policy corp_wireless-to-corp_wireless then permit

set security policies from-zone guest_wireless to-zone untrust policy guest_wireless-to-untrust match source-address any

set security policies from-zone guest_wireless to-zone untrust policy guest_wireless-to-untrust match destination-address any

set security policies from-zone guest_wireless to-zone untrust policy guest_wireless-to-untrust match application any

set security policies from-zone guest_wireless to-zone untrust policy guest_wireless-to-untrust then permit

set security policies from-zone guest_wireless to-zone guest_wireless policy guest_wireless-to-guest_wireless match source-address any

set security policies from-zone guest_wireless to-zone guest_wireless policy guest_wireless-to-guest_wireless match destination-address any

set security policies from-zone guest_wireless to-zone guest_wireless policy guest_wireless-to-guest_wireless match application any

set security policies from-zone guest_wireless to-zone guest_wireless policy guest_wireless-to-guest_wireless then permit

set security policies from-zone vpn to-zone corp_wireless policy vpn-to-corp_wireless match source-address any

set security policies from-zone vpn to-zone corp_wireless policy vpn-to-corp_wireless match destination-address any

set security policies from-zone vpn to-zone corp_wireless policy vpn-to-corp_wireless match application any

set security policies from-zone vpn to-zone corp_wireless policy vpn-to-corp_wireless then permit

set security policies from-zone trust to-zone corp_wireless policy trust-to-corp_wireless match source-address any

set security policies from-zone trust to-zone corp_wireless policy trust-to-corp_wireless match destination-address any

set security policies from-zone trust to-zone corp_wireless policy trust-to-corp_wireless match application any

set security policies from-zone trust to-zone corp_wireless policy trust-to-corp_wireless then permit

set security policies from-zone corp_wireless to-zone trust policy corp_wireless-to-trust match source-address any

set security policies from-zone corp_wireless to-zone trust policy corp_wireless-to-trust match destination-address any

set security policies from-zone corp_wireless to-zone trust policy corp_wireless-to-trust match application any

set security policies from-zone corp_wireless to-zone trust policy corp_wireless-to-trust then permit

set security flow tcp-mss ipsec-vpn mss 1350

To configure VLANs:
set vlans VOIP description "VOIP"

set vlans VOIP vlan-id 4

set vlans VOIP interface fe-0/0/1.0

set vlans VOIP l3-interface vlan.4

set vlans DATA description "DATA"

set vlans DATA vlan-id 5

set vlans DATA l3-interface vlan.5     

set vlans CORP_WIRELESS description "CORP_WIRELESS"

set vlans CORP_WIRELESS vlan-id 6

set vlans CORP_WIRELESS l3-interface vlan.6

set vlans GUEST_WIRELESS description "GUEST_WIRELESS"

set vlans GUEST_WIRELESS vlan-id 7

set vlans GUEST_WIRELESS interface fe-0/0/7.0

set vlans GUEST_WIRELESS l3-interface vlan.7


(You will notice that interface fe-0/0/1.0 is bound to the VOIP VLAN. However, if you take a look at the "set interfaces" section again you will see that interface fe-0/0/1 has a native VLAN ID of 5. This means that both VLANs can exist on this interface, but that by default devices will receive an IP in VLAN 5 unless otherwise specified (i.e. In this example a custom DHCP option was created for the voip VLAN, assigning a VLAN ID of 4.).)