Glad you figured it out. It is best practice to whitelist your IPs so you don't lock yourself out. I'm curious how you updated the password (and why you thought it would magically update the phone). If you used the 'Regenerate' button and it's a supported phone then 3CX should have triggered a reprovision automatically. But if you manually changed the password on the phone then it's up to you to then hit the re-provision button. Otherwise the phone will only check for configuration changes at a certain interval (depending on the phone and how it was configured) and then, noticing the config change, download the new config. However, in the meantime if the phone blacklisted itself before checking for an updated config you are SOL.