With the update to OpenVPN 2.6, the obsolete `cipher` option has been removed.
If your OpenVPN client configuration no longer works, try replacing the `cipher` parameter with `data-ciphers` in your file.

Try the following change in the configuration file:

Replace the line:

cipher AES-256-CBC

with the following three lines:

#cipher AES-256-CBC
data-ciphers AES-256-CBC:AES-256-GCM:AES-128-GCM:CHACHA20-POLY1305
data-ciphers-fallback AES-256-CBC

Restart the VPN on the phone.

If the VPN still does not work, further measures may be necessary on the client and/or server side.
In this case, talk to your system administrator.

Translated with DeepL.com (free version)

Systemphone compatibility-matrix as PDF-file

Setting up the IP telephone in the FRITZ!

1. Click on "Telephony" in the FRITZ!Box user interface.
2. In the "Telephony" menu, click on "Telephony devices".
3. Click on the "Set up new device" button.
4. Activate the option "Telephone (with and without answering machine)" and click on "Next".
5. Activate the option "LAN/WLAN (IP telephone)" and click on "Next".
6. Enter a user name with at least eight characters.
7. Enter a password with at least eight characters and clearly different from the user name and click on "Next".
8. Select the phone number for outgoing calls and click on "Next".
9. Specify which phone numbers the phone should respond to and click on "Next".
10. Click on "Finish" to save the settings and also confirm the settings on the FRITZ!Box if you are prompted to do so.

Set up identity in the COMfortel D-Series phone

1. Activate access to the web interface on the phone in the menu >Settings >Access >"Web administration (https)".
2. Open the COMfortel D-Series web interface.
3. Access during initial login: User name and password = admin
4. Click the arrow under Identities to edit.
5. SIP user name = FRITZ!Box user name
6. Password = FRITZ!Box password
7. SIP registrar = FRITZ!Box IP address
8. Authentication name - not required
9. Save entries and activate identity.

You can now make incoming and outgoing calls with the phone using the identity you have set up.

Further faq's on the topic:

How do I set up a VPN connection between a D-Series phone and a FRITZ!Box to operate the phone as an external extension?

Video tutorial: COMfortel D-Series - Setting up an external extension via OpenVPN

Video tutorial: COMfortel D-Series - Setting up an external extension via IPSec

Prerequisites

•     FRITZ!Box firmware version 06.30 or higher
•     Telephone firmware version 1.2 or higher
•     Fixed IP or a DynDns account via which the FritzBox can be reached externally
•     IPv4 address (IPv6 VPN connections are not supported by the FRITZ!Box)

Installation

Fritz!Box

Add a new user for the phone's VPN connection in the FritzBox under System / Fritz!Box User, e.g. D400Home and set a secure password; you do not need to enter an e-mail address.

Give this user the VPN authorisation, all other authorisations are not required for the VPN connection; the option Access also allowed from the Internet does not need to be active either.

Accept the settings and then display the VPN settings.

Make a note of the user name, the password you have assigned, the server address (fixed external IP or Dyn address) and the IPSec key.

Telephone

In the web interface of the device, the connection must be activated via the VPN switch on the VPN tab and IPsec Xauth PSK must be set as the VPN type.

Now enter the following data:

• Name: Any name for the VPN connection, e.g. VPN company
• Server: Server address (fixed external IP or Dyn address) of the Fritz!Box
• User name: User name for the VPN connection, in our example D400Home
• Password: Password of the user D400Home from the Fritz!
• DNS server: remains empty
• Search domains: remains empty
• Forwarding routes: IP addresses that can be reached via this VPN connection can be left blank. 192.168.178.0/24, for example, stands for the address range 192.168.178.1 - 192.168.178.255.
• IPsec ID: User name for the VPN connection, in our example D400Home
• Pre-installed IPsec key:IPSec key from the Fritz!Box
• The following certificates, keys or OpenVPN configurations do not need to be used in our example.

When you save the settings, the VPN connection is established. Successful connection establishment is signalled with a key symbol in the top line of the D-400 display.

A key can be assigned to the VPN function to conveniently switch the VPN connection on or off as required; the connection can also be controlled via the phone menu under Settings / Network / VPN.

The COMfortel D-Series is able to display information and also dialogues with the user via the mini-XML browser.

In order to achieve a specific browser call, e.g. via http request, the Lua script "minibrowserAutoStarter.lua" must be uploaded to the telephone via backup.
. Alternatively, the script can be inserted into the provisioning file.

In addition, a token for authentication must be provisioned:

Insert between "authTokens".

<authToken>
<token>here is the secret token inside</token>
</authToken>

There are some scripts available in the appendix for use.

Test call e.g. browser:

https://IP-Adresse of the phone/api/v1/exec/listenForMinibrowserTrigger?AuthToken=here is the token in it&url=http://Adresse where the XML is/to be retrieved XML
Example
https://192.168.1.60/api/v1/exec/listenForMinibrowserTrigger?AuthToken= mysteriousToken &url=http://192.168.1.159/mb_dialog.xml

Appendix:
Scripts

Starting with Telephone Firmware 1.4A and System Firmware 7.6B, it is possible to initiate dialling on D-Series telephones using action URLs.

If the telephone is not provisioned via the PBX, the following has to be regarded for manual setup:

• The web server must be activated on the phone under "Menu -> Settings -> Access".
   
• The first time the web server is accessed, the admin password must be changed.
   
• Under "Access" the option "Allow Action URLs" must be activated and a token must be generated.
  "Action URL Server" is not required.
   
• Copy the generated token and insert it on the PBX in the subscriber's properties under "Basic settings" as "CTI authorization code" (this is only available for subscribers with device type "Standard VoIP phone").

• Determine the MAC address of the telephone.

  This is located on the packaging and back of the phone.

• Create a VoIP subscriber with the device type "Standard VoIP telephone" in the configuration manager of the PBX under "Subscribers -> Phone numbers" and assign the corresponding MAC address to it or enter the MAC address.

• Create a provisioning file for the device type "COMfortel D-Series" on the PBX under "Subscriber -> IP Provisioning -> File Management" and grant the subscriber access authorization.

• Now connect the telephone. It is now assigned the corresponding settings from the assigned provisioning file and is then ready for use.