DHCP Option 160: Provisioning URL for Nova PBX Phones

← Network & Firewall

DHCP Option 160: Provisioning URL for Nova PBX Phones

DHCP option 160 hands a phone the address of its provisioning server while it is still getting an IP address. Set it once on the DHCP scope your phones use and every supported Yealink, Grandstream and Poly phone on that network configures itself on first boot — no per-phone URL entry, no per-phone password.

The value

Every Nova PBX organization has one provisioning URL that all of its phones share:

https://<slug>:<PIN>@cfg.sipstack.com/<slug>/

Placeholder	What it is	Where to find it
<slug>	Your tenant slug — also the HTTP Basic Auth username	Switchboard → Nova PBX → System → PBX Settings → Provisioning Access (the Username row)
<PIN>	Your organization’s provisioning PIN — 8 digits for organizations set up since September 2026 (older organizations keep the length they already have)	Same section. The URL is shown with the PIN masked; click Regenerate PIN to reveal a new one.

The PIN is shown once when generated. Lost it? Rotate it in Provisioning Access — phones keep working on the old PIN for 24 hours.

Replace both placeholders, including the angle brackets. A finished value looks like https://acme:48213977@cfg.sipstack.com/acme/ (example values).

No per-device credentials

There is nothing to copy from an individual phone’s page in Switchboard. The same URL provisions every phone in your organization; the provisioning server tells phones apart by MAC address, which you register under Nova PBX → Devices.

Which phones honour option 160

Brand	Behaviour on first boot
Yealink (T-series, W-series DECT bases, CP conference)	Reads option 160 by default and uses the whole URL, credentials included.
Grandstream (GRP, GXP, DP DECT bases)	Reads option 160 by default on current firmware. If a phone ignores it, enable Maintenance → Upgrade and Provisioning → Allow DHCP Option 43, 160 and 66 to Override Server.
Poly (VVX, Edge E, CCX)	Reads option 160 by default (the “Custom” boot-server option). The phone then fetches its universal master file and per-device files from the same URL.

Phones that do not support auto-provisioning (for example Cisco SPA) ignore the option; see the Cisco SPA Series Setup Guide for manual setup.

Entering the option

The string is identical on every DHCP server — only the menu path differs. 160, type String, value as above.

Windows Server DHCP

DHCP Manager → IPv4 → Scope Options (or Server Options to cover every scope) → Configure Options → tick 160 → String value:

160  String   https://<slug>:<PIN>@cfg.sipstack.com/<slug>/

If option 160 is not in the list, define it first: right-click IPv4 → Set Predefined Options → Add, name Provisioning URL, data type String, code 160.

pfSense

Services → DHCP Server → [interface] → Additional BOOTP/DHCP Options → Add:

Number: 160   Type: String   Value: https://<slug>:<PIN>@cfg.sipstack.com/<slug>/

ISC dhcpd (dhcpd.conf)

option provisioning-url code 160 = text;
option provisioning-url "https://<slug>:<PIN>@cfg.sipstack.com/<slug>/";

Place the second line inside the relevant subnet, pool or class block (or at the top level to apply everywhere), then restart dhcpd.

MikroTik RouterOS

/ip dhcp-server option add code=160 name=prov-url \
  value="'https://<slug>:<PIN>@cfg.sipstack.com/<slug>/'"
/ip dhcp-server network set [find] dhcp-option=prov-url

The single quotes inside the double quotes are required — they make RouterOS send the value as text rather than as hex.

FortiGate

See How to Enable DHCP Option 160 on a FortiNet Firewall — same value, entered under Network → Interfaces → [interface] → DHCP Server → Advanced → Options.

Verifying it works

1. Register a phone under Nova PBX → Devices, assign an extension to line 1 and click Apply Changes. Applying is what publishes the phone’s configuration to the provisioning server — until you apply, the server has nothing to hand out.

2. Power-cycle the phone (or renew its DHCP lease). Within a minute or two it should show the extension on its screen.

3. To test the URL without a phone, from any computer on the internet:

   curl -I -u <slug>:<PIN> https://cfg.sipstack.com/<slug>/<MAC>.cfg

   <MAC> is the phone’s MAC address in uppercase with no separators (for example 001565AABBCC). 200 means the file is published; 401 means the slug or PIN is wrong; 404 means the server has no configuration for that MAC — check the MAC, the extension on line 1, and that you applied changes.

Rotating the PIN

When you rotate the PIN in Provisioning Access, the previous PIN keeps working for 24 hours. Update option 160 at every site within that window; a phone that boots after the window with the old value gets 401 and shows no service until the DHCP value is corrected.

Security notes

• Option 160 is delivered to every DHCP client on that scope, not only to phones. Put phones on their own voice VLAN / DHCP scope and set the option there rather than on your general office scope.
• Treat the PIN like a password. If a phone is lost or a technician leaves, rotate the PIN and update DHCP.
• After 100 failed authentication attempts against your organization within an hour, the provisioning server pauses that organization’s provisioning for the rest of the hour. A wrong PIN in DHCP across a whole office can trigger this quickly — fix the value before rebooting more phones.

Related

• Devices — registering and provisioning phones
• PBX Settings — Provisioning Access
• Yealink Setup Guide · Grandstream Setup Guide · Polycom VVX Setup Guide · DECT Cordless Phones
• General Firewall Configuration for VoIP