Provisioning 100% remote worker phones and running into multiple issues.

[Ranac]

Sorry about the book here. I am trying to be comprehensive and this is driving me nuts right now ☹

Background
Maybe 15 remote users with different brand model hard phones (On approved list). Currently running on FreePBX migrating to 3cx V16 for an improved chat/collaboration user experience.

3cx is only a few days of experience for me right now so please be kind

I am hosted at an approved 3cx cloud hosting service. I created my own A record for the server and have a commercial SSL on the system that was all set up as part of the initial wizard. The setup of the system was a breeze. I was able to add a Twilio elastic SIP trunk, create all the IVR, ring groups users, firebase, and softphones in one day. Everything was very intuitive. The user interface was also well received.

Then comes phone provisioning issues. I am going to put some points out here to try and hopefully get a few things out of the way.

• The following settings were definitely confirmed.
• We are set for Direct SIP (STUN - remote)
• We confirmed "Disallow use of extension outside the LAN (Remote extensions using Direct SIP or STUN will be blocked)" is NOT selected
• The mac addresses are confirmed and pasted as well as the link
• The firmware for the phones is downloaded from the 3cx website and the phones are reset to factory default
• We unticked 'Block Remote Tunnel Connections (3CX App connections with Tunnel enabled & SBC will be blocked)'
• The 3cs firewall completed successfully
• For phones with the option "only accept trusted certificates" we have it disabled
• We are resetting to factory default phones that are active and working on a Freepbx and trying to provision to the new 3cx
• Some users have a modem with no firewall
• A couple locations have a stateful firewall and outgoing traffic was confirmed going out and finding its way back correctly

The problem we are having

We will set up the phone for a user in 3cx no problem. Then on the phone we add in the provisioning url, tell the phone to provision now.
Event log will quickly return "RPS request for Yealink T46S IP Phone of User Name (2061) delivered successfully"
Phone will do nothing. Wait 5-10 mins.. restart phone and still nothing
Then sometimes 45 mine an hour later the user will call and say the phone "just" prompted them with a login. We try extension and a couple different passwords and the prompt goes away. Still nothing.
Sometimes a phone will just register an hour after we gave up on it.

I read adding the mac address .cfg to the end of the provisioning link will allow downloading of the file. That works sometimes and other times it does not. It seems like when I am able to download the file with the link the phone registers. When it does not find a file the registration does not work. In looking I see there is a firmware and a firmware_new folder. If I create a new phone I see it populate in the firmware_new. There is a JSON file in there too that seems to be a key of some sort on what is available. Even if I see the new phone files in there the link still can’t find it.

Then when one finally does register you can’t really manage it. If I change a couple BLF's and say reprovision but nothing happens. Sometime reboot the remote phone from the management console works sometimes it does not. I have no insight into the firewall used by 3cx so I am not able to confirm that is working right. I also do not know what logs to look at that are even relevant to this.

Things I do not understand that may be clues?
When we create a phone for a user it auto populates SIP port 5065 and we need to change it to 5060
I am used to having to use a provisioning login and password. Everyone keeps saying no. Why would that not be used?

Am I just missing something here or is the provisioning not reliable in a full cloud environment?

Thanks in advance for any help anyone is able to provide.

Ted

 

[HRMNY]

If all the phones are at different locations, you can leave the default 5065 SIP Port and RTP Port Range.

If any phones share a location, you need to change the SIP Port, start the first phone with 5065, and count up for each additional phone (5066,5067,5068, and so on).

Same goes for the RTP Port Range start with 14000-14019, and count up (14020-14040, and so on).

To provision the phone: Menu > Settings > Basic Settings > Update Configuration
Phone should reboot after 10-15 seconds. If not power cycle the phone.

After rebooting, a prompt to enter username and password should appear.
Enter extension number, press the down arrow, and voicemail password, then press OK.

 

[BrenttG]

Additionally, if the phones are in all different places, i have seen some cheap firewalls also block port 5065 as they dont know what it is, switching a phone to 5060 for its sip port has gotten them to work before many times for us, however only when its a single phone at that location, as obviously only one phone can have that port per location.

A lot of very cheap modems and firewalls recognize 5060 is sip, and allow it to do things that other unknown ports are not allowed to do, similarly sometimes setting the sip port into the ephemeral range has the same effect as the firewalls know those ports are used for outgoing connections from all types of applications. So you could try a port like 45175 or higher, just to throw out a number.

 

[Ranac]

Thank you for your replies. My issue is really with provisioning though. If we use the credentials in the authentication area of the extensions general tab the phone will register and work. Although this does let people make calls it does not provision the phone with the lines or full functionality. The way I understand this is port 5001 is what provisioning uses. How would the sip port or media stream impact provisioning? Sorry like I said I am new to 3cx.

I do have a question around the need to make the sip and media ports unique on every phone.

So far we have had no problem running multiple phones in one location. As long as the firewall is stateful should that not handle managing where the traffic goes? I honestly could not imagine doing a roll out of a larger site if we had to track sip and rtp ports for every phone. I know there is the option of an SBC. Is that required for multiple phones then with 3cx?

 

[Saqqara]

using rps / stun setup - the username is the extension number and the password is the voicemail pin number

https://www.3cx.com/sip-phones/yealink-t4-series/

If you get no login info after restarting the phone, factory default it by holding the OK button in and follow the prompts

Note : voicemail does not have to be enabled, just use the voicemail pin

 

[leejor]

I do have a question around the need to make the sip and media ports unique on every phone.

So far we have had no problem running multiple phones in one location. As long as the firewall is stateful should that not handle managing where the traffic goes?

A lot is going to depend on the router. The local SIP port is going to have to be unique on each set behind the same router. To 3CX, the set appears to be (publicIP + port), so two sets with the same port, would appear to be the same device. Some routers are able to keep track of the voice ports and you don't get the "no audio" issues. However, having even two sets, can have problems. You may have to use the PBX Delivers Audio option for those extensions, at sites, with more than one, as a possible solution

 

[craigreilly]

You mention "Then on the phone we add in the provisioning url, tell the phone to provision now." - but I do not think that is part of the RPS Setup. The phone without any provisioning will check Yealink for RPS. Then if it has the RPD info, you login with extension and VM pin.

 

[SteveITS]

option of an SBC. Is that required for multiple phones

An SBC makes setup way easier, for instance not setting up the firewall rules per phone (phones just show up in 3CX as new phones). SBC also keeps voice traffic between its extensions on the LAN.

See https://www.3cx.com/community/threads/stun-vs-sbc.47510/

 

[Ranac]

OK wow thanks I would have never thought to use the voicemail pin as the provisioning password. We will try that with the extension as the user and see how that goes. Fingers crossed.

 

[Ranac]

A lot is going to depend on the router. The local SIP port is going to have to be unique on each set behind the same router. To 3CX, the set appears to be (publicIP + port), so two sets with the same port, would appear to be the same device. Some routers are able to keep track of the voice ports and you don't get the "no audio" issues. However, having even two sets, can have problems. You may have to use the PBX Delivers Audio option for those extensions, at sites, with more than one, as a possible solution

So are you saying a stateful firewall does not eliminate this problem? We have 3-4 phones running at the house right now (Covid stay @ home) running through a stateful sophos and they really are working well. Just need to get past registration. I understood this to be a problem prior to stateful firewalls. Any info you can provide on why this still happens with a 3cx would be awesome. I could not imagine rolling out a lot of these and keeping track of static settings..

Ted

 

[Ranac]

You mention "Then on the phone we add in the provisioning url, tell the phone to provision now." - but I do not think that is part of the RPS Setup. The phone without any provisioning will check Yealink for RPS. Then if it has the RPD info, you login with extension and VM pin.

Hi Craig! Thanks for helping here.

So question. Let's say I add a new phone for someone. I saw it creates the provisioning file or files in a folder with the brand name. It also makes entries in a JSON file in the root of a folder called firmware_new

What happens from there? If I profision the phone successfully does that file move to the plain firmware folder from the firmware_new folder? Does it get deleted? Is that what the provision button does in the 3cx phone area? create a new file there for the phone to find?

I was told there is also a time limit on how long that file is available to the phone. Do you know that to be correct?

I think the more I understand this process the better chance I have at getting this working reliably

Thanks a lot!

Ted

 

[Ranac]

OK results from testing tonight. I wish I was here sooner but things didn't go as I hoped.

Ok so I am going to be super literal here with the info we put in and the results.

Please assume all the checkmarks have been checked. This is 100% about what info/creds go where

In 3CX I have these available pieces of information to potentially use on provisioning a phone.

Extension General tab

Extension = hard coded to the number
Authentication ID =
Authentication Password =
Web Authentication Password = Says to use this with the extension I believe this is only for the soft phone

Voicemail Tab

PIN Number = Voicemail access and provisioning?


Phone Provisioning Tab

Phone Web Page Password = This has been proven to set the password of the web page so I assume that is its only function

In the phone we have a few fields. I am leaving the phone fields blank that were not sure of.

Auto Provision Area

Server URL = https://server.name.com:5001/provisioning/myspecialcode
Username =
Password =

Account Area
Register/Authenticate ID/name =
User ID/Name =
Password =
Server Host = server name resolvable (validated works)
Port = 5060 (validated works)

So first attempt tonight
Autoprovision area we had the
URL
username = extension #
Password = Voicemail Pin

Account area left blank.

We went ahead and applied the info to the phone. After a bit The user was prompted to log in the phone. They successfully logged in with the extension and VM PIN. Afterwards it did not provision and just sat there. After 5 mins we reset and same result. RPS error in log said not delivered to paste the link but the link was 100% confirmed accurate to the console. The log did have a trailing / in their link we did not have. Not sure if that is relevant.

We then added additional info into the SIP account area in the phone. Register name and username. Saved and applied. This time it said it got the provisioning file but it did not register. Restarted phone and waited still nothing. No registration or provisioning.

I then changed the extensions Authentication ID in 3cx to the extension. In the phone I changed the Register/Authenticate ID and User ID/Name in sip settings also to the configured extension number. Saved and applied and the phone registered. I saw the provisioning file was sent again in the 3cx logs. The phone did not provision. It has been over an hour now. We did try restarting it too. It does work now though and we CAN make calls. I tried using the a login that was not the extension in both phone fields while changing the Authentication ID on the extension in 3cx but the phone would NOT register with either combination. The only way I could get it to register was with the extension in both phone fields and the Authentication ID in the phone.

I can't help but feel like all these passwords need to be in the right place for this to work. Does anyone have a 100% definite for 3cx v16 what is needed for ID and password and what is not and where it goes?

What ID or login and what password goes in each section of the phone based on the available options in 3cx for RPS to work remotely?

Hopefully this all made sense.

Thanks!

Ted

 

[Saqqara]

Have you opened up port 5001 on the firewall ? To provision the phone remotely it requires access to https://server.name.com:5001

Can you access remotely the 3cx management console https://server.name.com:5001

When you enter the provisioning link directly into the phone, click on 'Autoprovision Now'. You do not have to do anything else as it picks up the config using https from the 3cx server

Same applies if you using stun / rps configure where you enter extension and voice pin, it connects to https://server.name.com:5001 , to pull down the configuration.

Have you checked your blacklist, and removed any entries

Have you unticked 'Disallow use of extension outside the LAN (Remote extensions using Direct SIP or STUN will be blocked)' under Options for the extension.

When setting up the extension within 3CX, have you entered the correct mac address of the phone ?

Are you running the correct firmware for the phone ? - Step 1- https://www.3cx.com/sip-phones/yealink-t4-series/#h.7ls0w5vyhlnd

 

[JohnS_3CX]

Hi Ted

STUN Provisioning
In our phone guides, once you pick the model you wish to configure, we include all the instructions and firmware links, just for future reference

Example: Yealink T4x series seen via https://www.3cx.com/support/

Firmware folders
As for the the firmware folder, don't worry about it now. The PBX will always keep the latest firmware for any devices you add to your extensions, regardless if whether they are provisioned yet. I would not recommend to modify anything at all in that folder unless we instruct you to (as part of troubleshooting)

Troubleshooting provisioning
Once you log in with the credentials as above, the provisioning URL is revealed to the phone so it can download the config file. The phone then opens a connection to the full provisioning URL (the equivalent of pasting it in manually). If the phone can reach the login prompt, and you enter the correct details, there isn't much stopping it any more. Accessing login means it reached your PBX on port 5001.From there, you do not need to know any passwords or configuration, its designed with dropshipping devices to users in mind, where they just 1. plug it in 2. enter extension and pin number and the rest is automatic.

Note: the phone may be able to fully provision (and I mean entirely) and yet still say "no service" because now although it has all the info populated, something blocks it from registering. Some examples:

1. You tried manually registering it with wrong credentials and it got blacklisted - check your PBX blacklist. By the way if you see RPS was delivered, yet resetting the phone still doesn't make it prompt for login, it may be possible your own firewall at the PBX end is blocking certain users home IPs, or simply the home user plugged the ethernet cable in the "PC" port of the phone instead of the "WAN" port
2. You did not disable "Disallow use of extension outside the LAN"
3. You forgot to set the provisioning method to Direct SIP (STUN - remote)
4. The router/modem at the phone site, is blocking SIP registration

Number 4 may be your biggest problem to overcome. Many providers can block SIP on their modems (because they reserve the ports for their own landlines configured on the modem already), they can have SIP ALG / NAT Helpers enabled by default which you may not be able to turn off even from the modem UI, and these services can interfere with registration and phones calls or even cause silent calls. This is not something you can control always but there are solutions:

• Use the webclient - it does not get impeded by any of the above
• Use the 3CX Mobile app - it has a built in tunnel, that bypasses blocked ports and ALG Helpers
• User the 3CX App for Windows - it also has the tunnel capability
• Use an SBC - It does the job of the tunnel, but for desk phones

If you can avoid having desk phones, you can avoid these common issues. STUN can indeed work but it relies on more factors than the above solutions, some of which are not under the admin's control.

 

[Ranac]

Hi Ted

STUN Provisioning
In our phone guides, once you pick the model you wish to configure, we include all the instructions and firmware links, just for future reference
View attachment 15392
Example: Yealink T4x series seen via https://www.3cx.com/support/

Firmware folders
As for the the firmware folder, don't worry about it now. The PBX will always keep the latest firmware for any devices you add to your extensions, regardless if whether they are provisioned yet. I would not recommend to modify anything at all in that folder unless we instruct you to (as part of troubleshooting)

Troubleshooting provisioning
Once you log in with the credentials as above, the provisioning URL is revealed to the phone so it can download the config file. The phone then opens a connection to the full provisioning URL (the equivalent of pasting it in manually). If the phone can reach the login prompt, and you enter the correct details, there isn't much stopping it any more. Accessing login means it reached your PBX on port 5001.From there, you do not need to know any passwords or configuration, its designed with dropshipping devices to users in mind, where they just 1. plug it in 2. enter extension and pin number and the rest is automatic.

Note: the phone may be able to fully provision (and I mean entirely) and yet still say "no service" because now although it has all the info populated, something blocks it from registering. Some examples:

1. You tried manually registering it with wrong credentials and it got blacklisted - check your PBX blacklist. By the way if you see RPS was delivered, yet resetting the phone still doesn't make it prompt for login, it may be possible your own firewall at the PBX end is blocking certain users home IPs, or simply the home user plugged the ethernet cable in the "PC" port of the phone instead of the "WAN" port
2. You did not disable "Disallow use of extension outside the LAN"
3. You forgot to set the provisioning method to Direct SIP (STUN - remote)
4. The router/modem at the phone site, is blocking SIP registration

Number 4 may be your biggest problem to overcome. Many providers can block SIP on their modems (because they reserve the ports for their own landlines configured on the modem already), they can have SIP ALG / NAT Helpers enabled by default which you may not be able to turn off even from the modem UI, and these services can interfere with registration and phones calls or even cause silent calls. This is not something you can control always but there are solutions:

• Use the webclient - it does not get impeded by any of the above
• Use the 3CX Mobile app - it has a built in tunnel, that bypasses blocked ports and ALG Helpers
• User the 3CX App for Windows - it also has the tunnel capability
• Use an SBC - It does the job of the tunnel, but for desk phones

If you can avoid having desk phones, you can avoid these common issues. STUN can indeed work but it relies on more factors than the above solutions, some of which are not under the admin's control.

This is great. Every piece of it. I have by process of elimination (using 3 different locations for testing including a location that worked for a couple phones) except the 3cx firewall at the host. When I asked I was told that info is not shared but to rest assured its working correctly.

 

[Ranac]

When I look in the logs of the Sophos at my location I can see the phone sending requests. When this is not working my logs are all Lan to Wan allowed. While I wait for an expected response I do not see any attempts from the 3cx even hit the wan port to try sending info to the phone. The few times it did work I saw the traffic hit the wan port and go to the phone no problem. The funny part is when it does work no password prompt on the phone comes up.

 

[Ranac]

Currently I have two T46S phones successfully provisioned and a T38. I am afraid to touch any of them. One of the T46S phones is using the cert too so I am fairly confident once this is figured out using the cert will be OK.