Prerequisites

•     FRITZ!Box firmware version 06.30 or higher
•     Telephone firmware version 1.2 or higher
•     Fixed IP or a DynDns account via which the FritzBox can be reached externally
•     IPv4 address (IPv6 VPN connections are not supported by the FRITZ!Box)

Installation

Fritz!Box

Add a new user for the phone's VPN connection in the FritzBox under System / Fritz!Box User, e.g. D400Home and set a secure password; you do not need to enter an e-mail address.

Give this user the VPN authorisation, all other authorisations are not required for the VPN connection; the option Access also allowed from the Internet does not need to be active either.

Accept the settings and then display the VPN settings.

Make a note of the user name, the password you have assigned, the server address (fixed external IP or Dyn address) and the IPSec key.

Telephone

In the web interface of the device, the connection must be activated via the VPN switch on the VPN tab and IPsec Xauth PSK must be set as the VPN type.

Now enter the following data:

• Name: Any name for the VPN connection, e.g. VPN company
• Server: Server address (fixed external IP or Dyn address) of the Fritz!Box
• User name: User name for the VPN connection, in our example D400Home
• Password: Password of the user D400Home from the Fritz!
• DNS server: remains empty
• Search domains: remains empty
• Forwarding routes: IP addresses that can be reached via this VPN connection can be left blank. 192.168.178.0/24, for example, stands for the address range 192.168.178.1 - 192.168.178.255.
• IPsec ID: User name for the VPN connection, in our example D400Home
• Pre-installed IPsec key:IPSec key from the Fritz!Box
• The following certificates, keys or OpenVPN configurations do not need to be used in our example.

When you save the settings, the VPN connection is established. Successful connection establishment is signalled with a key symbol in the top line of the D-400 display.

A key can be assigned to the VPN function to conveniently switch the VPN connection on or off as required; the connection can also be controlled via the phone menu under Settings / Network / VPN.

Setting up the IP telephone in the FRITZ!

1. Click on "Telephony" in the FRITZ!Box user interface.
2. In the "Telephony" menu, click on "Telephony devices".
3. Click on the "Set up new device" button.
4. Activate the option "Telephone (with and without answering machine)" and click on "Next".
5. Activate the option "LAN/WLAN (IP telephone)" and click on "Next".
6. Enter a user name with at least eight characters.
7. Enter a password with at least eight characters and clearly different from the user name and click on "Next".
8. Select the phone number for outgoing calls and click on "Next".
9. Specify which phone numbers the phone should respond to and click on "Next".
10. Click on "Finish" to save the settings and also confirm the settings on the FRITZ!Box if you are prompted to do so.

Set up identity in the COMfortel D-Series phone

1. Activate access to the web interface on the phone in the menu >Settings >Access >"Web administration (https)".
2. Open the COMfortel D-Series web interface.
3. Access during initial login: User name and password = admin
4. Click the arrow under Identities to edit.
5. SIP user name = FRITZ!Box user name
6. Password = FRITZ!Box password
7. SIP registrar = FRITZ!Box IP address
8. Authentication name - not required
9. Save entries and activate identity.

You can now make incoming and outgoing calls with the phone using the identity you have set up.

Further faq's on the topic:

How do I set up a VPN connection between a D-Series phone and a FRITZ!Box to operate the phone as an external extension?

Video tutorial: COMfortel D-Series - Setting up an external extension via OpenVPN

Video tutorial: COMfortel D-Series - Setting up an external extension via IPSec

With the update to OpenVPN 2.6, the obsolete `cipher` option has been removed.
If your OpenVPN client configuration no longer works, try replacing the `cipher` parameter with `data-ciphers` in your file.

Try the following change in the configuration file:

Replace the line:

cipher AES-256-CBC

with the following three lines:

#cipher AES-256-CBC
data-ciphers AES-256-CBC:AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305
data-ciphers-fallback AES-256-CBC

Restart the VPN on the phone.

If the VPN still does not work, further measures may be necessary on the client and/or server side.
In this case, talk to your system administrator.

Translated with DeepL.com (free version)

• Determine the MAC address of the telephone.

  This is located on the packaging and back of the phone.

• Create a VoIP subscriber with the device type "Standard VoIP telephone" in the configuration manager of the PBX under "Subscribers -> Phone numbers" and assign the corresponding MAC address to it or enter the MAC address.

• Create a provisioning file for the device type "COMfortel D-Series" on the PBX under "Subscriber -> IP Provisioning -> File Management" and grant the subscriber access authorization.

• Now connect the telephone. It is now assigned the corresponding settings from the assigned provisioning file and is then ready for use.

As an example, the assignment of a key with the "Speed dialling" function:

• The key assignment is possible under "menu -> Settings -> Function keys".
• Select a level and key for the assignment.- Select the desired function, in this case "Speed dial".
• If required, enter a label under "Key label" and confirm with the "OK"-key.
• Enter the desired phone number (internal/external) under "Number/URI" and confirm with the "OK"-key.
  
  Note:
  Text entry is active by default. To enter digits, either press the key repeatedly until the digit is selected or hold it down to select the digit immediately.
• Under "Identity", select the identity for which the key is to be used and confirm with the "OK"-key.
• Confirm with "OK" on the display and either select another key for assignment or exit the menu with the "Back-" or "Home"-key.

Starting with Telephone Firmware 1.4A and System Firmware 7.6B, it is possible to initiate dialling on D-Series telephones using action URLs.

If the telephone is not provisioned via the PBX, the following has to be regarded for manual setup:

• The web server must be activated on the phone under "Menu -> Settings -> Access".
   
• The first time the web server is accessed, the admin password must be changed.
   
• Under "Access" the option "Allow Action URLs" must be activated and a token must be generated.
  "Action URL Server" is not required.
   
• Copy the generated token and insert it on the PBX in the subscriber's properties under "Basic settings" as "CTI authorization code" (this is only available for subscribers with device type "Standard VoIP phone").