Remote Setup, IP Blacklisting, Yealink RPS MAC

[Fulcrum731]

Hi All,

I am trying to setup a (remote) IPT network for a customer to trial 3CX. However, it has not been as easy as I would have liked, not all 3CX's fault. Let me explain, I have the following setup:

8x FBM Phones - Yealink T46S and T46Us (bought of Facebook MarketPlace (FBM) as we did not want to spend the earth if this did not work)
1x Good Phone - Yealink T46U
3CX SMB (up to 10 users)
Network 192.168.0.1/24
Remote jumpbox to access the whole network

We have a few issues (not made easier by my being remote). When we tried to factory reset the FBM phones, they kept reverting back, every time we did, we could get in for 1 minute, and then we would lose the password access. I understand this to be a previous RPS associated with the phone's MAC addresses -
Please provide any fixes or guidance here (our last resort will be to speak to Yealink to request the RPS service to be removed from our MAC addresses/Serial Numbers).

The one good phone that we had, Yealink T46U - not associated with any previous RPS was configured through the 3CX portal and seemed to take the config, however, it never came up when I was administering the phones. Is there another step here that we are missing?

Now for the blacklisting, because of the failed attempts, I am now locked out of the portal and I cannot get in to even try and configure the Good Phone. I am now worried that if I wanted to come off 3CX, even the good phone may be permanently locked to 3CX?

Welcoming any advice and guidance.

 

[JamieR]

If you are not running an SBC on the remote jump box, local to the phones, then you need to be as that will be how the phones will be configured and also connect to 3CX in a reliable manner - no official direct STUN/SIP support in v20.

Indeed you need to get Yealink to remove the phones from their RPS - it's free and straightforward, you just need to sign up to an account (iirc a partner account...is what I have) and put in the request and it'll be sorted. You can also block the Yealink RPS IP addresses at a local firewall level if you're in a rush

With regards to the blacklisting, it sounds like your WAN IP hasn't been added as a trusted IP. If you've locked yourself out completely then 3CX support will have to help you there

 

[paulodagraca]

Hello Fulcrum731,

The blacklist on the 3CX is based on IP adres, so change your IP address and you will be able to login.

The IP address is based on your internet connection, so change internet connection, go home, work, goto starbucks or any other place with WIFI where you can login to the 3CX. Or just use a VPN if you have the option.

Did you know you can access the 3CX with chrome on your smartphone.
Once logged in, clear the blacklist, and you should be all good again.

For the Yealink MAC list, i will send you a PM.

Paulo

 

[Fulcrum731]

@JamieR - Thank you for your quick and informative reply. Regarding the SBC, I thought I could configure the first phone as the 'Router', is this what you are referring to when you say 'STUN/SIP' support?

Good to know that Yealink will help me. If I can get back into the account, the firewall blocking sounds like a really good shout, as a workaround.

 

[Fulcrum731]

Hello Fulcrum731,

The blacklist on the 3CX is based on IP adres, so change your IP address and you will be able to login.

The IP address is based on your internet connection, so change internet connection, go home, work, goto starbucks or any other place with WIFI where you can login to the 3CX. Or just use a VPN if you have the option.

Did you know you can access the 3CX with chrome on your smartphone.
Once logged in, clear the blacklist, and you should be all good again.

For the Yealink MAC list, i will send you a PM.

Paulo

Hey Paulo, thanks, I have PM'd you back. Great shout about the Blacklisting, I did not realise that was how it worked. I will try it from my home computer.

 

[JamieR]

@JamieR - Thank you for your quick and informative reply. Regarding the SBC, I thought I could configure the first phone as the 'Router', is this what you are referring to when you say 'STUN/SIP' support?

Good to know that Yealink will help me. If I can get back into the account, the firewall blocking sounds like a really good shout, as a workaround.

Ah nice, sorry hadn't seen you had a T46U. Your "router phone" is then an SBC, so you don't need a separate installation. Essentially that will make a tunnel connection back to 3CX and all other local will tunnel their SIP traffic etc. through it.

Set other phone to use the routing device of the phones and once the RPS and IP blacklist issues have been sorted then I expect you'll be fine. Paulo has kindly offered to help with the RPS (Yealink can be fairly quick to reply) so fingers crossed you'll be sorted soon.

 

[Fulcrum731]

Hey Paulo, thanks, I have PM'd you back. Great shout about the Blacklisting, I did not realise that was how it worked. I will try it from my home computer.

Thanks, Paulo, yep, I am in.

 

[Fulcrum731]

Ah nice, sorry hadn't seen you had a T46U. Your "router phone" is then an SBC, so you don't need a separate installation. Essentially that will make a tunnel connection back to 3CX and all other local will tunnel their SIP traffic etc. through it.

Set other phone to use the routing device of the phones and once the RPS and IP blacklist issues have been sorted then I expect you'll be fine. Paulo has kindly offered to help with the RPS (Yealink can be fairly quick to reply) so fingers crossed you'll be sorted soon.

Thanks @JamieR, thanks to Paulo, I am back in, however, but because I am remote, I am unsure if the phone is actually registered. If I go on the phone (via its web browser) it just says registering.

 

[Fulcrum731]

....and if I look on the 'Team' section on my portal, it says 'Not Registered'.

 

[SteveITS]

What firmware version? If it’s old enough it can trigger the blacklist especially if trying to set up as a router phone.
https://www.3cx.com/docs/phone-firmwares/

 

[JohnS_3CX]

Please provide any fixes or guidance here (our last resort will be to speak to Yealink to request the RPS service to be removed from our MAC addresses/Serial Numbers).

Hi,

That's not a last resort, that's actually the right thing to do as they are the only ones that can help you in this situation.

Once that's done, factory reset all of them to confirm they're not being automatically configured any more.

Now upgrade all the phones to the firmware that 3CX supports from here https://www.3cx.com/docs/phone-firmwares/
If your phones have an older version that cannot jump to the one we support, you will again need to contact Yealink to provide you with the in between version first. That's just how it's done with most IP phone brands.

So now that all your phones are upgraded and reset you can start adding them to 3CX:
- Make all the T46U router phones - all of them no exceptions
- The remaining phones T46S that cannot be routers, can be provisioned behind the SBCs of the router phones spread evenly
- Make sure they're all wired, no WiFi

And you are done. If you do it otherwise, they will attempt to register without an SBC and your IP will get banned for 24h.

 

[Fulcrum731]

Ok, thank you for all your help so far. So on my 1 good phone (not registered to any MAC RPS services), I looked on the 3CX firmware guide and saw that it needed upgrading.

Now the phone is on Firmware Version:
108.87.0.16

However, when I now go to Account>Register and look at 'Register status' on the T46U's web browser it shows 'Disabled'

Not sure what I am doing wrong, any advice would be gratefully received.

 

[Fulcrum731]

Also, am i right in saying that this new 'Good' phone (T46U) that I have is now on 3CX/Yealink's RPS? If so, how would I remove this, if I wanted to reset the phone?

 

[Fulcrum731]

Hi,

That's not a last resort, that's actually the right thing to do as they are the only ones that can help you in this situation.

Once that's done, factory reset all of them to confirm they're not being automatically configured any more.

Now upgrade all the phones to the firmware that 3CX supports from here https://www.3cx.com/docs/phone-firmwares/
If your phones have an older version that cannot jump to the one we support, you will again need to contact Yealink to provide you with the in between version first. That's just how it's done with most IP phone brands.

So now that all your phones are upgraded and reset you can start adding them to 3CX:
- Make all the T46U router phones - all of them no exceptions
- The remaining phones T46S that cannot be routers, can be provisioned behind the SBCs of the router phones spread evenly
- Make sure they're all wired, no WiFi

And you are done. If you do it otherwise, they will attempt to register without an SBC and your IP will get banned for 24h.

Hi @JohnS_3CX, many thanks, I thought in respect to Router phones, you only needed one to act as the SBC, but you mention all of them (I think I will end up having at least 3 on my network). Could you please explain this to me?

 

[Fulcrum731]

I think this may be causing my blacklisting (and the phone not auto-provisioning) but I cannot figure out why and how to stop it.


SIP request (REGISTER) from 94.197.244.250 was rejected. Reason: Block WAN requests is ON. . Message:. REGISTER sip:1710.3cx.cloud:5060 SIP/2.0. Via: SIP/2.0/UDP 94.197.244.250:58185;branch=z9hG4bK1289436268. Max-Forwards: 70. Contact: <sip:[email protected]:58185>. To: "NAME_REMOVED" <sip:[email protected]:5060>. From: "NAME_REMOVED" <sip:[email protected]:5060>;tag=1289287441. Call-ID: [email protected]. CSeq: 2 REGISTER. Expires: 120. Allow: INVITE, INFO, PRACK, ACK, BYE, CANCEL, OPTIONS, NOTIFY, REGISTER, SUBSCRIBE, REFER, PUBLISH, UPDATE, MESSAGE. Proxy-Authorization: Digest username="NVH6Tfqw0h",realm="3CXPhoneSystem",nonce="414d53590007233d13:d266d13648a40cf8f927b905e99fcc53",uri="sip:1710.3cx.cloud:5060",response="3ebffa30a544572231bc3f04148ceada",algorithm=MD5. User-Agent: Yealink SIP-T46U 108.86.119.3 805e0c813283. Allow-Events: talk, hold, conference, refer, check-sync. Mac: 80:5e:0c:81:32:83. Content-Length: 0

 

[TheodorosG_3CX]

SIP-T46U 108.86.119.3

You need to fix the firmware version first. Below is the list of the latest 3CX Supported and tested firmware versions:
• https://www.3cx.com/docs/phone-firmwares/

 

[Fulcrum731]

You need to fix the firmware version first. Below is the list of the latest 3CX Supported and tested firmware versions:
• https://www.3cx.com/docs/phone-firmwares/

Hi @TheodorosG_3CX, I have fixed the firmware, I am hoping this will fix my Blacklisting and I can log on from the account in question, I guess I will have to give it 24 hours?

 

[Fulcrum731]

Hi @TheodorosG_3CX, I have fixed the firmware, I am hoping this will fix my Blacklisting and I can log on from the account in question, I guess I will have to give it 24 hours?

Now the phone is on Firmware Version:
108.87.0.16

 

[paulodagraca]

Hello,

The best way now (i thnink): it may sound like some work, but it can be done fast:

Copy MAC address, delete phone from extention.
Add the phone again to the extention with copied MAC and save.
(MAC will be activated on RPS by 3CX)

Reboot phone, this will activate the 'get new config'
All should be good from now, after the phone has done (all) the reboot.

If not, let us know, what did happen (or not happen).

Paulo

 

[K_SAK]

Hi @JohnS_3CX, many thanks, I thought in respect to Router phones, you only needed one to act as the SBC, but you mention all of them (I think I will end up having at least 3 on my network). Could you please explain this to me?

Hi,

Since the phones have the SBC functionality there is no benefit of running them through each other. Actually doing that would create a single choke point unnecessarily.
This way each router phone connects directly, independently and securely to your 3CX PBX via its build in SBC.

If in the future you add some non-router phones to the same location, spread them evenly across the existing SBCs so none gets overloaded at some point.