Wifi Poly phones wont register with their cloud service through MX / MR APs

[peat]

We have had a customer have new Wifi Poly phones installed and the company installing the phones asked us to whitelist a load of IP ranges and urls inbound and outbound.

I was told the phones werent working inbound or outbound and they weren't registering with the cloud service.

I could see the phones had got DHCP ok.  On packet capture I could see the phones were having an issue with NTP and registering so in the security section I allowed those IPs in the trusted IPs section of threat protection and allowed the URLs in the AMP section of threat protection.

I did a packet capture again on the phone and the ntp and registering issue had gone so I assumed the phones would work now.  But Ive been told they still dont work.

What am I missing?   

One peculiar thing is if I look at the phone in the clients section, under policy it shows 1 rule for the layer 3 which is a wifi rule allowing the wifi to print to the lan printer but its not showing the other rules which is deny wifi from accessing the lan and the other which is outbound allow any.  

Could that be the cause of this issue?  Should that policy section for the client say 3 rules apply?

[RaphaelL]

Hi ,

In your pcap , do you see TLS issues ? Invalid certs / expired ?

[peat]

I cant see anything that suggests that to be honest.

[BenjaminEvans]

Nice work! Adjusting threat protection settings often solves tricky registration issues.

[alemabrahao]

Check it out: Help Center - Line Unregistered Error on Poly Phone

[peat]

Thanks.  That doesnt seem to quite be the same issue.

[RaphaelL]

I'm mentioning this because ntp issues = time issues = tls issues. That might not be your case tho.

[alemabrahao]

I suggest you open a support case.

[peat]

Yeah thanks.  Already have done.  So hopefully they can spot something.

[michalc]

Hi @peat ,

In your packet capture do you see the SIP register getting an OK from your PBX? 

Does the PBX settings need to be adjusted? In my previous role as a VoIP engineer we had a very strict firewall rules for our PBX where we only allowed the Public IP of the locations we managed. Rest was blocked.

[peat]

I dont think there is an OK from the pbx (if im reading the pcap correctly).   It looks like it tries to register several times and gets nowhere.

[michalc]

You are correct. This should be your main focus on further troubleshooting this issue. Phone not registered = no phone calls. 
Is that PCAP from AP or your firewall?

Is the SIP server information on the phone correct? Have you verified it with your PBX team?

I'd recommend to run another pcap on WAN interface of your firewall while the phone is attempting to register. Do you see SIP register egressing WAN interface? If so the issue is on your PBX side.

[PhilipDAth]

Are you sure the phones aren't attaching to WiFi?

Do the phones need any special DHCP options?  If so, are you 100% sure they are added correctly?

If you do a packet capture of a phone, do you see two way traffic with whatever it is talking to?

[peat]

Hi Philip,

Phones look like they are attaching to wifi fine as they are getting a dhcp address in that wifi ssids subnet.

The phone company hasnt told me any setup is needed on the firewall side other than the whitelisting of ips and urls.   

On other cloud voip phones on other firewalls all ive needed to do is make sure the phone subnet has unrestricted internet out and thats it they all work fine. 

I had hoped this one would be the same but its my first time dealing with cloud voip and meraki so im a bit stumped as to what im looking for / at tbh.   I did a pcap on the phone and I dont think there is two way traffic.   It looks to me like its trying to register and getting nowhere but im not seeing the NTP mentioned like before I added the whitelisting stuff so that seems to be a step forward.

[PhilipDAth]

Do you have any WiFi firwall rules configured?

The capture shows that the phones are able to make a DNS request, but get zero response to the SIP register command.  Either the packets are not leaving your network - or the issue is on the other end.

Do you see the same issue if you do a packet capture on your firewall on the Internet circuit?  Aka, do you see the packets leaving your site?

[peat]

Yeah.  From my OP

"

One peculiar thing is if I look at the phone in the clients section, under policy it shows 1 rule for the layer 3 which is a wifi rule allowing the wifi to print to the lan printer but its not showing the other rules which is deny wifi from accessing the lan and the other which is outbound allow any.  

Could that be the cause of this issue?  Should that policy section for the client say 3 rules apply?"

I did a pcap on the internet interface and then filtered on the ip of the phone and nothing showed.

[peat]

If its any help, I ran pcap again this morning when the customer was trying to call and this line appeared.  Ive had a google but it doesnt seem to bring up anything relevant

[peat]

The phone company has said i need to let port 5060 inbound and outbound.   Outbound is surely fine as the outbound rule is inbound - outbound any any. 

But is this how to do a inbound rule for 5060?  Sorry I am new to Meraki (I use mainly cisco and sophos) so dont want to accidentally either let everyone in or disrupt the customer.

[peat · Accepted solution]

For info Meraki support has said the Fw isnt forwarding SIP traffic to the internet so I am to update the firmware.   I had assumed Meraki auto updated everything, that being one of the benefits but when I went into the firmware update section i could see there's updates to do including the MX