SMB - first router phone blacklisted IP on setup

[NWIT Admin]

I am hesitant for the transition to V20, but look forward to it in the long run. That said, I seem to have encountered a strange issue when I setup a 3CX hosted V20 SMB for the first time and I hope that someone can guide me to a proper solution.

Short version:
First phone addition at a location, yes it is a router phone, blacklists the IP if you don't turn off WAN block for the first time registration

Long Version:
1. Set up V20 SMB (3CX hosted)
2. Finally found documentation to add a phone (Yealink T54W) and added provisioning link to phone (router phone capable, so it will become my SBC/router)
3. Rebooted phone and it starts to download 3CX firmware
4. Phone reboots with 3CX firmware and seems to hang
5. Attempt to find issue on the Dashboard and I get kicked out going to that page
6. Attempt to log back in to Dashboard and get IP Blacklisted message on login
7. Join my laptop to my cell phone's hotspot to log back in and see in the logs that my home internet IP address is blacklisted due to the phone attempting to connect and WAN access is still blocked for phones on the user
8. Now I have to open a support ticket (one of only 10 I am allotted) just to unblock the IP? For the record, I'm not spending one of my support tickets for this as I have discovered that not being able to use MoH in SMB is a non-starter and I will scrap this setup.

Questions:
1. Is this expected behavior? As a router phone (first for an IP address) should I turn off WAN block just to get it registered the first time? If so, why is THAT not in the documentation (or did I miss it)?
2. If I have a remote user with a desk phone my options are to set up the user with a router phone OR SBC OR leave off WAN block?
3. Why would I NOT be able to manage blacklisted IPs in the SMB version, security doesn't seem to be a PRO edition defining feature! If security is only for the PRO edition, I can't say that I would EVER use the SMB edition.

Possible solution:
Perhaps a wizard (nothing says simplicity like a "Add First/Router Phone at This Location" wizard) to guide that first phone addition at a location (new IP remote office/user).

I'm just not clear on how that first phone at a location can be setup without blacklisting the IP so any helpful tips would be appreciated. I think it would be the turning off WAN block until registered as router, but I'm just trying to confirm. While that seems a little sketch from the security side, I get this is a work in progress, so I will certainly follow that process if necessary and turn ON WAN block again after the router phone is registered.

Thanks in advance.

 

[SteveITS]

Ensure the phone has current firmware before starting, otherwise the connection will fail and trigger a block. Normal phones can join and then be updated in 3CX. (or if there's another SBC, this one can join, be updated in 3CX, removed, and added again as a router phone)

Remote desk phones need a router phone or SBC.

SMB is multi-tenant so doesn't have the higher level access to edit the block list.

 

[NWIT Admin]

Hi Steve, thanks for taking the time to respond. Looks like the firmware is not up to date, so it could definitely cause this issue.

Thanks again.

 

[SteveITS]

Yeah it's going to be an issue until all the old phones work their way out of distribution...

 

[TheodorosG_3CX]

As mentioned previously you need to ensure that the phone is on the latest firmware version in order to avoid this situation.

 

[UrielFoster]

The behavior you described seems unexpected, but may be related to security settings. The documentation probably misses this point. For remote users, setup via a router phone or SBC may be possible, but may require disabling WAN blocking. Management of blacklisted IP addresses may be limited for security reasons. It is possible that future updates will resolve this issue or you may need to contact support to unblock the IP address.

 

[TheodorosG_3CX]

For the SMB installation you can contact the Support Team to release the ip or just wait for 24 hours.

 

[John Ruby]

For the SMB installation you can contact the Support Team to release the ip or just wait for 24 hours.

That's funny because I told by support that I had to buy a ticket to release the ip

 

[John Ruby]

I am hesitant for the transition to V20, but look forward to it in the long run. That said, I seem to have encountered a strange issue when I setup a 3CX hosted V20 SMB for the first time and I hope that someone can guide me to a proper solution.

Short version:
First phone addition at a location, yes it is a router phone, blacklists the IP if you don't turn off WAN block for the first time registration

Long Version:
1. Set up V20 SMB (3CX hosted)
2. Finally found documentation to add a phone (Yealink T54W) and added provisioning link to phone (router phone capable, so it will become my SBC/router)
3. Rebooted phone and it starts to download 3CX firmware
4. Phone reboots with 3CX firmware and seems to hang
5. Attempt to find issue on the Dashboard and I get kicked out going to that page
6. Attempt to log back in to Dashboard and get IP Blacklisted message on login
7. Join my laptop to my cell phone's hotspot to log back in and see in the logs that my home internet IP address is blacklisted due to the phone attempting to connect and WAN access is still blocked for phones on the user
8. Now I have to open a support ticket (one of only 10 I am allotted) just to unblock the IP? For the record, I'm not spending one of my support tickets for this as I have discovered that not being able to use MoH in SMB is a non-starter and I will scrap this setup.

Questions:
1. Is this expected behavior? As a router phone (first for an IP address) should I turn off WAN block just to get it registered the first time? If so, why is THAT not in the documentation (or did I miss it)?
2. If I have a remote user with a desk phone my options are to set up the user with a router phone OR SBC OR leave off WAN block?
3. Why would I NOT be able to manage blacklisted IPs in the SMB version, security doesn't seem to be a PRO edition defining feature! If security is only for the PRO edition, I can't say that I would EVER use the SMB edition.

Possible solution:
Perhaps a wizard (nothing says simplicity like a "Add First/Router Phone at This Location" wizard) to guide that first phone addition at a location (new IP remote office/user).

I'm just not clear on how that first phone at a location can be setup without blacklisting the IP so any helpful tips would be appreciated. I think it would be the turning off WAN block until registered as router, but I'm just trying to confirm. While that seems a little sketch from the security side, I get this is a work in progress, so I will certainly follow that process if necessary and turn ON WAN block again after the router phone is registered.

Thanks in advance.

I just set up my first SMB and not a happy camper. When setting up new users make sure to turn off wan block or your new phone will blacklist your IP. It was an immense battle just to get to a human being and then I was told to go take a seat in the corner for 24 hrs. I had serious egg on my face with my customer and everything came to a standstill.

Up mulling this over more for the weekend I realize what if a use messes up logs in wrong to many times, what if a buggy phone goes authentication wonky. Because If I can't get in to whitelist my IP and all cloud phones every goes down. 3CX wake up with your poor Engineering Design not allowing us access to the Blacklist/Whitelist because what if phones get locked out and say an injured person try to dial 911, or an intruder situation with late night cleaning people. Are you thinking of the liability because your design locks out the phones????? I always whitelist my internal IPs and Internet IPs (Hosted) on my Pro configurations. This is seriously dumb design