Windows On-prem upgrade to v20, provisioning not working

[Pewaukee]

After upgrading I cannot provision any phones, nor does firmware upgrade work (T54W). Firewall check is all green. All have 3CX firmwares. Phones are T54W, T46U, and 1 T46S. It worked great in v18. Tried turning the firewall off on PC running 3CX, no other apps. Split DNS is setup, no SIP Alg. When I click 'Provision' the popup says its going to re-provision but it doesn't. In the event log it says "Provisioning file for MAC 0004138D5003 of user 250 requested by 10.x.xxx.145 was successfully generated". Any ideas?

 

[SteveITS]

Is the web server certificate valid? Is it a 3CX FQDN?

 

[Pewaukee]

Yes, its a 3CX FQDN.

 

[SteveITS]

Is the web cert valid?

You said the phones have 3CX firmware but also mentioned upgrading. What version are they?
https://www.3cx.com/docs/phone-firmwares/

 

[PD-SII]

I ran into a similar thing when going to v20 with my Yealinks, but I was using custom templates. I needed to add .ph to the template name in the "Models" section at the top and then delete/re-add the phones with the same template .. but now modified with the .ph. It was a bit time-consuming, but works

If you are not using custom templates, then you shouldn't be affected by this, but thought I'd mention it in case you were

 

[Pewaukee]

All phones except 3 T54W are on the latest firmware. Not using custom templates. I manually upgraded 2 of the 5 T54W phones to v96.87.0.16. Most are T46S with v66.86.0.15. I'm assuming that's the latest version because there's no 'Upgrade' next to them.
Correction, when I try a re-provision nothing is recorded in the event log. What I saw originally was Ext. 250, a Snom PA1 that I logged into to register it.

 

[SteveITS]

The versions are listed on the page I linked above but yes 66.86.0.15 is current for that one.

Is the web cert valid if you browse to it?

 

[Pewaukee]

Yes, the lock is there left of the URL and when I click on the lock it says 'connection secure'. I changed a BLF in 3CX and tried logging into that phone and clicking 'Auto Provision' and that didn't work either. Then I changed the provisioning URL in the phone from using the internal IP address to https://fqdn/provisioning/pewtj1bbtx, same as in 3CX portal and still won't provision from phone nor 3CX.

 

[Pewaukee]

Solved. Turns out in the Fortinet firewall (DNS Server) had the wrong internal IP for the FQDN. What threw me was when pinging the FQDN from the 3CX PC, it was correct, turns out there was a Host file (must have been created by 3CX upgrade) with the correct DNS IP: 127.0.0.1 - FQDN and thats the only PC I tested internal split DNS from.

 

[SteveITS]

Ah, yeah that'll do it. FWIW, ping honors the hosts file, but nslookup queries DNS.