yealink auto provision from box asks for login/password

[dandenson]

When letting a yealink phone autoprovision from RPS out of the box, I'm asked for a login and password. What is this? I'm having to login to the web ui with admin/admin and paste in the autoprovision URL instead of letting it just happen.

 

[Saqqara]

All info is here depending on model of Yealink - it is the extension number and voicemail pin number

https://www.3cx.com/sip-phones/yealink-t20p-t22p-t26p-t28p/
https://www.3cx.com/sip-phones/yealink-t4-series/
https://www.3cx.com/sip-phones/yealink-t5-series/

 

[dandenson]

thanks. scrolled right past that section.

 

[dandenson]

I can't get this to work. I have a new system with extension 00000, I first boot a T48 and paste the provisioning URL in and it provisions out properly. Then, I factory reset the phone and it comes up to the login screen.

enter 00000
enter the voicemail pin
says config updating and then right back to the login screen. If I do this enough times, it will say config skipped.

keep in mind I verified connectivity and config for the phone by successfully provisioning w/ cut'n'paste in the phone's UI and making no other changes.

 

[dandenson]

well, looks like this only works with STUN configs. Have to start with STUN and then reprovision after the phone is up :/

 

[eddv123]

STUN is the only setup method which uses RPS, but you shouldn't have to paste the provisioning link into the phone.

Be aware that you should only deploy one or two phones per site and if anymore then a VPN or SBC should be used.

 

[dandenson]

I tested this on a handful of phones. I have to configure the phones initially as STUN to use RPS provisioning else I can't login when prompted. Once provisioned, I can switch to 'local' which is actually routed over a VPN and then reprovision/reboot the phone.

 

[cobaltit]

I'm not exactly sure what you tested besides what looks to be some really awkward way of doing things. If the phones are meant to be local then just provision them as local. There's no login needed. What exactly were you trying to accomplish since it seems to have strayed from your original thread topic.

 

[jmitch11]

If you've setup your DHCP options correctly the phone should automatically provision, even over the VPN.

 

[dandenson]

Mystery solved. PEBKAC

so I configured the extensions and accepted the defaults. I went back and changed the voicemail pins. Not realizing that 3CX doesn't update RPS when this is done. It seems 3CX updates RPS when you regenerate an extension, or reprovision an already provisioned phone.

The phones then never connects to 3CX because those login credentials are actually sitting in RPS and it's got essentially stale credentials.

If you regenerate the extension you wipe out your self set voicemail pin but that does cause 3CX to update RPS.

So the moral of the story is that once you add the phone to the extension, you can't change the voicemail pin until that phone is provision if you want to use RPS. So change the voicemail pin before you add the phone, or wait.

The local vs STUN was just a distraction.

 

[JohnS_3CX]

Strictly STUN Remote Provisioning:
There are no stale credentials in RPS, because RPS only stores the temporary provisioning link pointing to your PBX.

It just tells Yealink to point that phone towards your PBX, and that's where the credential check takes place.

Hence you can change your PIN as many times as you like just before you enter it in the deskphone, and it will authenticate when you press ok (not with the RPS server, but directly with your PBX for security).

https://www.3cx.com/docs/manual/configuring-ip-phones/

 

[dandenson]

I tested this four hours. I just replicated it again (on v16...) and if I change the voicemail pin and factory reset the phone I can't login. I may have discovered something odd in v16? Any logs I can collect to check this out?

 

[JohnS_3CX]

When you say you can't log in what does that mean? Do you get a message on the phone saying wrong password or something along those lines? If your phone PIN was entered wrongly it will likely get blacklisted

The Event Log on the first page of your management console will show you if the phone tried to log in and was blocked