Solved Grandstream GXP2130 Only Seeing ACKs

[Telcreek]

Hi All. I am testing a GXP with an AWS hosted 3CX instance running 15.5.0 on Debian. I have an HTek UC926 and Snom 821 RPS provisioned and registered. I am now trying to get a Grandstream GXP2130 provisioned the same way but having some trouble. I followed the instructions here:

https://www.3cx.com/sip-phones/grandstream-gxp21-series/

I manually updated the firmware of the GS to 1.0.9.68.

The phone does not provision, I do not get the two reboots and login prompt on the phone itself, as described in the 3CX howto.

I've run Wireshark on pcaps from the phone itself, my router and PBX, all I am seeing are ACKs both ways. Well, I am seeing PSH, ACKs from the PBX side so I am guessing it's waiting on something more from the phone side. I don't have the benefit of seeing what AWS may or may not be blocking. Being that I have two other registered phones of different brands using the same method, I don't suspect the AWS firewall, unless Grandstream is sending something out of the ordinary. Any advice welcome and thanks in advance.

 

[Telcreek]

A correction, from the phone packet capture, I don't see the GXP reaching out *at all* other than to DNS.

 

[YiannisH_3CX]

Hello @Telcreek

Is the RPS request sent successfully in the 3CX management console? Also have you tried to factory reset the phone in case there are settings in the phone that prevent it from reaching out to the RPS server?

 

[Telcreek]

Hi. Yes, I factory reset the phone after the firmware update and started from scratch on the config. I may try this again, just start over and see what happens. Also, yes, I get RPS request sent successfully message in the Event Log.

 

[Telcreek]

So after trying another factory reset and no success, I watched a packet trace while it factory reset. I left the phone sit after doing so for a good long while and just watched. The phone eventually downloads a new firmware on it's own, possibly after no feedback to an onscreen confirmation of auto-update. It *downgrades* itself to a 1.0.7. The phone only seems to communicate to this IP: 45.55.195.232. DNS queries peg this IP as a Grandstream IP hosted at Digital Ocean. So, not sure how to get around this if I want to use RPS. The phone has a mind of it's own, it's clearly not getting pushed the 3CX RPS or the RPS sent isn't taking precedence over what's there. In any event, I've reached out to Grandstream support to see what they say. This phone has been in my possession for more than a year and has been configured to another PBX (not via RPS). I am also not using running a bootp server as well nor is the phone reaching out to anything on my network. We'll see what GS says.

 

[craigreilly]

Sounds like the phone config is locked somehow to be finding that old Firmware and downgrading itself.

 

[Telcreek]

OK, the downgrade to 1.0.7 was an old tftp setup, that's corrected. It's interesting that the GS seems to check for tftp even when not being directed to do so by the DHCP server.

Grandstream support insists on me using 1.0.9.69 and says 1.0.9.68 (available from 3CX website) is "beta". They also give me older templates and instructions for Windows only.

So, I still seem to be stuck here. This phone is simply not reaching out. I even tried the instruction on the "manual" provisioning, sticking the provisioning URL into the Config Server Path on the GS and the phone does not make any attempt to contact anything other than DNS queries to www.grandstream.com, openweathermap.org and the IP for the Grandstream ipvideo service. I've even taken down firewalls at both locations rather than monitor for blocks.

Question for 3CX: Just a thought, seeing how RPS apparently works, what is stopping someone from creating a config on their PBX for RPS with a MAC address of a phone I own and hijacking my phone?

 

[Telcreek]

Interesting development. After reading about a recent BGP hijack, I got paranoid and changed my DNS servers from Google to another service. Very coincidentally, after rebooting the phone to utilize the new DNS the phone starts reaching out! The GXP2130 is now registered, per instructions, using RPS. It is complaining about firmware 1.0.9.69 as suspected. I'll back up one, now that it works. What I was seeing from tcpdump (or not seeing rather), the change in DNS service and the recent BGP hijack are an unlikely coincidence, this must have been the problem.

RE my last question to 3CX about RPS, I now see that some level of authentication using the phone's vmail credentials likely mitigates a phone hijack via 3rd party (manufacturer's RPS) server but what stops another PBX falsely updating Grandstream's RPS server with different provisioning info? This would at least cause breakage. What am I missing?

 

[Telcreek]

Another aside, having gone back down to 1.0.9.68, the phone uses the template properly and all line keys display the registered account. Grandstream support is not on the same page FYI.

 

[YiannisH_3CX]

RE my last question to 3CX about RPS, I now see that some level of authentication using the phone's vmail credentials likely mitigates a phone hijack via 3rd party (manufacturer's RPS) server but what stops another PBX falsely updating Grandstream's RPS server with different provisioning info? This would at least cause breakage. What am I missing?

As you have mentioned, for the phone to get provisioned you need the username and the password that you need to input on the device it self. Also you should be the only one that knows the device MAC address. And once the phone is provisioned it will not check the vendors RPS server since it already has a configuration. The phone will only check for RPS provisioning if it gets factory reset.
So even if someone does get lucky with a MAC address the phone would have to be in a factory reset state and to be restarted.

Glad to see the issue has been resolved and thank you for sharing your solution.