Provision Issues - Yealink

[shahrad]

Can I get some help. We are trying to provision our Yealink phones to 3CX and have followed the instructions and videos that are out there, but it is still not working.
We did manage to change a phone to have the 3CX background and have some of the information, but it still has no service and currently displaying the Warning: Account Unregistered on the phone. any assist on this would be greatly appreciated!

 

[SteveITS]

Where is the 3CX server? If remote did you set up an SBC or are you using router phones?

 

[CentrexJ]

Did you apply the latest 3cx recommend firmware? If trying to use sbc/router mode it requires the 3cx version not what ships from yealink.

 

[shahrad]

Where is the 3CX server? If remote did you set up an SBC or are you using router phones?

I have set up an SBC but I am not sure if I have done it correctly. I have installed the SBC on Windows and copied and pasted the couple of prompts, after that the SBC shows as green light under Voice and Chat. Then I go to provision a new phone and just pick the SBC and provision and nothing happens. Am I suppose to somehow point the phones to the SBC or is it automatic? I think I have done it correctoy and nothing happens. Mostly the logs say the WAN is enabled, hence the denial.

 

[shahrad]

Did you apply the latest 3cx recommend firmware? If trying to use sbc/router mode it requires the 3cx version not what ships from yealink.

Yes

 

[SteveITS]

> WAN is enabled

? Please copy/paste the log entry.

What model phone?

Are they new phones?

Does the firewall checker pass?

Where is the server hosted?

It should be automatic once you add it to 3CX.

 

[patrickb_de]

Is there a firewall blocking requests to the Yealink RPS server? Are the phones currently in use with another PBX, or are they brand new, out-of-the-box devices?

In any case, you can try uploading the device configuration manually. Log in to your web client, go to the extension, and copy the provisioning link. Then append the MAC address to the link using the .cfg extension. Download the .cfg file and upload it in the phone’s web interface under the Config tab.

Example:
https://provi.link/folder/MAC.cfg

You can also manually add the provisioning link in the phone’s web interface and start the provisioning process from there.

Some phones will not register if they are not running the latest firmware. This most commonly occurs when setting up a phone in router phone mode. In this case, it is required to use the latest firmware version.

Additionally, it is possible that you are using your own FQDN with a certificate that is not supported by Yealink. Some certificate authorities are incompatible, and Yealink devices may not trust those certificates

 

[shahrad]

First anf foremost, I want to say G-d Bless You All for taking your time to help. You are all truly wonderful people and I am very appreciative for all of this. I wish you and your loved ones the most amazing holiday season and a Happy New Year. Thank you.

 

[shahrad]

Here is the Event Error Log:

Event Log​

Severity	Warning
Event ID	12291
Date	12/21/2025 11:10 AM
Details	SIP request (REGISTER) from 76.89.92.23 was rejected. Reason: Block WAN requests is ON. . Message:. REGISTER sip:rabbitel.3cx.us:5060 SIP/2.0. Via: SIP/2.0/UDP 76.89.92.23:5060;branch=z9hG4bK3974208751. Max-Forwards: 70. Contact: <sip:[email protected]:5060>. To: "Erick Contreras" <sip:[email protected]:5060>. From: "Erick Contreras" <sip:[email protected]:5060>;tag=1559603923. Call-ID: [email protected]. CSeq: 2 REGISTER. Expires: 120. Allow: INVITE, INFO, PRACK, ACK, BYE, CANCEL, OPTIONS, NOTIFY, REGISTER, SUBSCRIBE, REFER, PUBLISH, UPDATE, MESSAGE. Proxy-Authorization: Digest username="0ROVTpNBo8",realm="3CXPhoneSystem",nonce="414d53590030023d05:06d9b5191f80e646c3c0c718731d3842",uri="sip:rabbitel.3cx.us:5060",response="b2f8efe99d0e63c749d1aa75d982c384",algorithm=MD5. User-Agent: Yealink SIP-T48G 35.83.0.136 001565f48a05. Allow-Events: talk, hold, conference, refer, check-sync. Mac: 00:15:65:f4:8a:05. Content-Length: 0

 

[shahrad]

Is there a firewall blocking requests to the Yealink RPS server? Are the phones currently in use with another PBX, or are they brand new, out-of-the-box devices?

In any case, you can try uploading the device configuration manually. Log in to your web client, go to the extension, and copy the provisioning link. Then append the MAC address to the link using the .cfg extension. Download the .cfg file and upload it in the phone’s web interface under the Config tab.

Example:
https://provi.link/folder/MAC.cfg

You can also manually add the provisioning link in the phone’s web interface and start the provisioning process from there.

Some phones will not register if they are not running the latest firmware. This most commonly occurs when setting up a phone in router phone mode. In this case, it is required to use the latest firmware version.

Additionally, it is possible that you are using your own FQDN with a certificate that is not supported by Yealink. Some certificate authorities are incompatible, and Yealink devices may not trust those certificates

First anf foremost, I want to say G-d Bless You All for taking your time to help. You are all truly wonderful people and I am very appreciative for all of this. I wish you and your loved ones the most amazing holiday season and a Happy New Year. Thank you.

Here is the error log:

Event Log​

Severity	Warning
Event ID	12291
Date	12/21/2025 11:10 AM
Details	SIP request (REGISTER) from 76.89.92.23 was rejected. Reason: Block WAN requests is ON. . Message:. REGISTER sip:rabbitel.3cx.us:5060 SIP/2.0. Via: SIP/2.0/UDP 76.89.92.23:5060;branch=z9hG4bK3974208751. Max-Forwards: 70. Contact: <sip:[email protected]:5060>. To: "Erick Contreras" <sip:[email protected]:5060>. From: "Erick Contreras" <sip:[email protected]:5060>;tag=1559603923. Call-ID: [email protected]. CSeq: 2 REGISTER. Expires: 120. Allow: INVITE, INFO, PRACK, ACK, BYE, CANCEL, OPTIONS, NOTIFY, REGISTER, SUBSCRIBE, REFER, PUBLISH, UPDATE, MESSAGE. Proxy-Authorization: Digest username="0ROVTpNBo8",realm="3CXPhoneSystem",nonce="414d53590030023d05:06d9b5191f80e646c3c0c718731d3842",uri="sip:rabbitel.3cx.us:5060",response="b2f8efe99d0e63c749d1aa75d982c384",algorithm=MD5. User-Agent: Yealink SIP-T48G 35.83.0.136 001565f48a05. Allow-Events: talk, hold, conference, refer, check-sync. Mac: 00:15:65:f4:8a:05. Content-Length: 0

 

[shahrad]

> WAN is enabled

? Please copy/paste the log entry.

What model phone?

Are they new phones?

Does the firewall checker pass?

Where is the server hosted?

It should be automatic once you add it to 3CX.

First anf foremost, I want to say G-d Bless You All for taking your time to help. You are all truly wonderful people and I am very appreciative for all of this. I wish you and your loved ones the most amazing holiday season and a Happy New Year. Thank you.

Here is the error log:

Event Log​

Severity	Warning
Event ID	12291
Date	12/21/2025 11:10 AM
Details	SIP request (REGISTER) from 76.89.92.23 was rejected. Reason: Block WAN requests is ON. . Message:. REGISTER sip:rabbitel.3cx.us:5060 SIP/2.0. Via: SIP/2.0/UDP 76.89.92.23:5060;branch=z9hG4bK3974208751. Max-Forwards: 70. Contact: <sip:[email protected]:5060>. To: "Erick Contreras" <sip:[email protected]:5060>. From: "Erick Contreras" <sip:[email protected]:5060>;tag=1559603923. Call-ID: [email protected]. CSeq: 2 REGISTER. Expires: 120. Allow: INVITE, INFO, PRACK, ACK, BYE, CANCEL, OPTIONS, NOTIFY, REGISTER, SUBSCRIBE, REFER, PUBLISH, UPDATE, MESSAGE. Proxy-Authorization: Digest username="0ROVTpNBo8",realm="3CXPhoneSystem",nonce="414d53590030023d05:06d9b5191f80e646c3c0c718731d3842",uri="sip:rabbitel.3cx.us:5060",response="b2f8efe99d0e63c749d1aa75d982c384",algorithm=MD5. User-Agent: Yealink SIP-T48G 35.83.0.136 001565f48a05. Allow-Events: talk, hold, conference, refer, check-sync. Mac: 00:15:65:f4:8a:05. Content-Length: 0

 

[SteveITS]

Is the phone on the same network as the server?

 

[KyriacosS_3CX]

That looks like it might not be going through the SBC, since if it is green the registration would not trigger the Block WAN function.

 

[patrickb_de]

Traffic does not pass through the SBC and instead tries to connect directly to the PBX.

You can fix this in three ways:

First option:
Reconfigure the phone in 3CX.
Make sure the device is configured as a phone that uses the SBC, then reprovision the phone.

Second option:
Configure the SBC manually in the phone’s web GUI.
Log in to the phone, go to the Account tab, and select the profile of the first account. Enable the Outbound Proxy option and enter the local IP address of the SBC. Port is 5060. Apply the changes and check if it works.

Third option:
Deactivate the option “Block remote non-tunnel connections (Insecure!)”.

Important:
Make sure to remove the IP address from the blocked IP list if its listed. Otherwise, none of these methods will work. Also, please reset the user credentials (sip-auth, sip-password), as some credentials and the FQDN were exposed in the error message you posted.

 

[KyriacosS_3CX]

Important:
Make sure to remove the IP address from the blocked IP list if its listed. Otherwise, none of these methods will work. Also, please reset the user credentials (sip-auth, sip-password), as some credentials and the FQDN were exposed in the error message you posted.

Thank you for spotting and highlighting this @patrickb_de

 

[shahrad]

Is the phone on the same network as the server?

yes

 

[SteveITS]

Then you should not use an SBC or router phone but also shouldn’t be connecting to a public IP…do you have split DNS set up? Then it would connect over the LAN.

 

[patrickb_de]

yes

Are you sure? The IP addresses listed in the log/error message indicate something else. Your T48G is coming from 76.89.92.23 and is trying to connect to rabbitel.3cx.us (142.93.80.141). The first IP belongs to Spectrum, and the second one belongs to DigitalOcean.

In my opinion, it is possible that your 3CX instance is hosted by 3CX, so @KyriacosS_3CX or some other 3cx technican could take a closer look at what is going wrong there. And no, split DNS is not required In this case.

Why do I think it is hosted by 3CX? Most “hosted by 3CX” instances are hosted on DigitalOcean.

 

[KyriacosS_3CX]

I think @shahrad probably meant the phones are on the same network as the SBC, but from the logs it seems they are trying to connect directly and not using the SBC.

Perhaps the path to follow (as long as the SBC is showing Green status) would be:

Delete phones from PBX users,
add phones again using their MAC addresses, making sure they are set to connect via the SBC,
factory reset the phones.