Yealink phones have provisioning only once

[Inxss]

Hi2All.
Story
We're have very strange behavior with auto provisioning with our Yealink phones after update from v18 to v20 3CX.

Before upgrade we have 100% working scenario:
1. Prepare phone (firmware, and place to network)
2. Get a 66 option from TFP when boot
(the only one option is delivered to the phone - "Settings > Auto Provision > Server URL" - FQDN pbx)
3. After that, we can add the phone to the user's account on 3CX PBX by entering the MAC address.
4. You can make any changes in user's account, like a BLF or name.. and ALL of changes are sucsessfully provision to the phone.
Profit!!

What we have after upgrade PBX:
After linking phone MAC address to user account, sucsessfully provision to phone get only once time!!
You can change anything in your account or phone... But nothing will happen.
If you need to reprovision the phone - you need to go to WebUI and reset to factory. You will get provision after reset, but once..again and again...
It does not depend on the model phone and the availability of SBC (we tried installing SBC on the client network Site and checking the result for PNP provison, but we didn't get a needed result)

Technical info:
PBX 3CX v20.0 Update 5 (Build 527 Beta) on premise Windows Server 2019 installation
TFTP Server for DHCP option 66 (https://www.3cx.com/sip-phones/tftp-server/)
Split-DNS Setup correctly, in local network FQDN resolve local address.

Different park (more than 300) of Yealink phones:
- T19P E2
- T26
- T21 E2
- T30P, T31 P
- T40P
- T46S, T46U
- T48S
All phones have 3CX Supported latest firmware

Network has Site-to-Site IPSEC Connections with OSPF routes:
First Site:
- Public IP with own FQDN for 3CX + local nework 192.168.XX.0/24
- PBX 3CX placed in this network
Second Site:
- WAN + local network 192.168.YY.0/24
- DHCP Server with option 66 (IP address of PBX)
- Yealink phones placed in this netwok
Third and etc sites the same..

 

[JohnS_3CX]

If it provisions the first time, but never again after the initial provisioning then you most likely have custom certificates that the Yealinks don't support.

We enable higher security once provisioned so they won't accept any certificates blindly after initial provisioning.

 

[Inxss]

If it provisions the first time, but never again after the initial provisioning then you most likely have custom certificates that the Yealinks don't support.

We enable higher security once provisioned so they won't accept any certificates blindly after initial provisioning.

Hi
, we turned off https because phones didn't receive provision at all.
Right now, all variables on the PBX give HTTP://link

And..example - we need to rename user and phone - nothing happens without factory reset for phone

 

[JohnS_3CX]

We only support HTTPS I'm afraid so this will not work.
If you want to user plain HTTP, you need to provision the phones via IP, not FQDN.

So when adding a phone pick the IP in the Network Interface

 

[Inxss]

Ok. Step by step:

We only support HTTPS I'm afraid so this will not work. If you want to user plain HTTP, you need to provision the phones via IP, not FQDN

It seems no work.. What was tested:
1 Unpack NEW T46S.
2 Go to extension on PBX and switch to Network interface to IP 192.168.XX.6
3 Go to phone 192.168.YY.103 and edit Server URL
4 Push button "Auto Provision Now" - and successfully get extension

So it is the first time.
Check correct work for provision service:
- On the phone edit NAME from correct to 12345, and see this on display.
- Go to Settings - Auto Provision - and push button > Nothing
- Go to PBX - Users - Edit - IP Phone - and push Reprovision > Nothing
by the way - push reboot - it works..

Ok.. go to extension and switch reverse to HTTP FQDN..
we got the same story.

IF switch to HTTPS:
Phone can not get provision from PBX..
hard reset \ new or not - the same..

Do you have any idea with logging on pbx or phone to fix this???
On v18 it works perfectly, but now we have a huge problem at remote offices

 

[JohnS_3CX]

- On the phone edit NAME from correct to 12345, and see this on display.

This is not a valid test - it will not update those fields if you change them by hand.
A valid test is to provision your phone, then edit a BLF from 3CX and save.

As for HTTPS, it won't work in your case but ignore that for now and use IP based only.

 

[Inxss]

This is not a valid test - it will not update those fields if you change them by hand.
A valid test is to provision your phone, then edit a BLF from 3CX and save.

As for HTTPS, it won't in your case but ignore that for now and use IP based only.

Ok try yours test right now:
My phone just reseted to factory and provision - Sucess
On extension was edit blf and save. - ok
Try to push Reprovision - Nothing to change...
Try to reboot phone to force.. nope

Next test
Change URL in the phone to HTTPS FQDN
Change PROVISIONING_LINK_EXT_SEC to https://
Change PROVISIONING_LINK_LOCAL_SEC to https://
now reproduce steps 1 test - Nothing

 

[JohnS_3CX]

We have checked all the basics together, and the phone is not reprovisioning as expected. You are also reporting that HTTPS provisioning is failing. This means that other things have been changed or are different from the expected config (which works fine here when I test it in our lab using 3CX FQDN and certificates).

You will need PCAP to see the traffic between the phones and server, you need to see whether the network config allows the download of the CFG, and whether option 66 is not overriding some other behaviors. You also need to learn why HTTPS does not work at all. This is a bit too complicated to solve on a Forum thread. In addition if you have been editing the PBX parameters or templates we have no idea how the system will behave so in this case, I'd suggest you get help from a 3CX Partner to investigate what happens.

 

[Inxss]

Reread first thread please, all you ideas and test are placed there.

1. We have own FQDN. All paramaters are explained at first post on the thread.
2. Please explain method to download CFG. From what and protocol.
3. Do you have description for opt 66 ? It's not a service by default configuration. If i turned 66 off what will be changed?
4. In addition, i know what i changed in parameters and know how to turn its back.

So i can PCAP from pbx and phone... what i need to find?