SNOM & STUN Provisioning

[stevesamuals]

Good Morning Everyone,

We are migrating our estate to 3CX from another platform, the issue I'm having is remote provisioning of the handsets. we have 360+ Handsets across 30+ customers as you are all aware we don't like to rely on end-users to carry out any simple takes we would like to factory reset the phones and have them auto-provision remotely.

Here is the issue -

I can't use an SBC, our customers use all 18 DSS keys on the SNOM 725 and we would have too many BLFs for a large majority of the customer base.

STUN works but the end-user would have to enter their extension and voicemail pin into the handset, this would end up with us having to visit all our customers to account for human error.

Option 66 in DHCP wouldn't work for us due to limited hardware access at some sites.

Does anyone know of a way to provision the handsets via stun without the end-users having to log in or have any interaction with the phone?

Sorry, I'm fairly new to VoIP, and thanks for any help.

 

[JohnS_3CX]

This falls outside the scope of 3CX and you should expect issues in this type of installation.

You could however put the phones on a separate network with its own DHCP and VPN Firewall, connecting back to the main 3CX site, and treating the phones as LAN-provisioning devices. That should address all your requirements.

 

[Saqqara]

for stun to work, you will have to do some firewall changes , and dhcp reservations

You can have multiply SBC servers at the same location and spread the phones across the SBC server

As above create site to site vpn tunnels, where you configure the phones as lan

 

[ClsVip]

The only other way is to actually enter the provisioning URL into the phones via the phone's web UI, this would not require manual intervention from the user but you will need to access each phone's web UI to enter the prov URL.

 

[stevesamuals]

Thanks for the responses, we won't have access to the firewall / machines and handsets in some instances and while this might well be a SNOM issue and not 3CX, I'm just finding it confusing that while testing other platforms entering the MAC was enough for the phones to provision using SRAPS. (SNOM RPS).

The only option is STUN provisioning, entering the provisioning URL is also complicated with limited access, we might have to "educate" all users to just log in to the handsets once factory reset.

The only reason I'm asking in the 3CX forums is that STUN provisioning for SNOM on 3CX requires the phones are "logged in" after being factory reset.

Thanks

 

[Saqqara]

stun is not going to work for you, if you have multiple phones are the same location. - Do a search on this forum, to get stun to work with 3cx you have to make changes to the firewall, etc as per url I posted.

If you do not have access to the firewall, etc, SBC is the only solution (may require multiple SBC servers)

 

[JohnS_3CX]

You started by rejecting SBC, but since you have no control over the networking equipment, it's even more of a reason that you consider SBC, the only viable remaining solution given the limitations you stated.

You can have all the BLFs you want, just review the hardware recommendations and deploy accordingly:
https://www.3cx.com/docs/recommended-hardware-specifications-for-3cx/


- Remote provisioning on-demand will work fine (so long as multicast is not being blocked on purpose on the LAN)
- Common STUN issues are eliminated: missing inbound calls, having crosstalk, having BLFs going down, registration failures
- Traffic remains encrypted
- internal calls stay local (no WAN bandwidth used)