Third party IP phones keep registering with new port number

[Cyrus777]

We have a MX84 at an office with YEALINK phones. Recently the phones started acting weird and we get a lots of call disruptions and phones not ringing. We opened a case with voip service provider and they see clients get registered with a few different port numbers and have a few active sessions at their end. They are blaming our MX that it sends the sip traffic on several different port numbers for one client and causing the issue. How do we force the MX to not assign more than one port number to each IP phones for SIP? 

[BlakeRichardson]

Have the phones always been running through the MX?

Have you updated the firmware recently? 

I doubt it would be the MX as IP phones require a SIP IP, port and credentials. The phone will only communicate with the SIP server on the designated port. The fact their PBX is allowing multiple logins with the same extension is a concern. I would try turning off concurrent registrations and see if that helps. 

[Cyrus777]

we haven't update the MX yet and yes, they have been working before with the same setup with Meraki MX in place. I'm not sure about how to turn off concurrent registrations but I have rebooted all the phones at the same time for new registration and fresh network config but it doesn't help. I have whitelisted all the phones and disabled the security features on firewall for all of them. We have no blocker as far as I can see. The phone company is blaming on PAT function on Meraki appliance but I have nothing configured for NAT/PAT on the dashboard. 

[BlakeRichardson]

Concurrent registrations will be something at the PBX end. If you can't see the setting you might want to query the provider but a way to test this would be to setup a second handset with the credentials of an existing extension and see if it successfully registers. 

If so I would be sending them a very grumpy email as allowing this by default for all extensions is extremely insecure. 

[PhilipDAth]

If you check Organization/Firmware Upgrades - does it show any recent firmware upgrades (such as an automatic upgrade)?

Anything in Security & SD-WAN/Security Centre/MX Events ?

Failing that, are you running a current stable or better firmware release?

You could also try temporarily turning off AMP and intrusion detection in case they are related.

[Cyrus777]

there is a pending upgrade but has not been done yet. I don't see any specific event related to SIP. AMP and Blocked categories have been disabled for IP phones.