Teleworker problem with calling in-office IP desk phones

[dmichels79]

I am having troubles with teleworker phones making calls to other Mitel phones in the office. When a teleworker calls an in-office phone there is “dead air” and no audio can be heard by either person. We have been advised to open udp ports 50000 – 50511 from the MBG server in our DMZ to the entire internal voice lan where our MiVoice, MiCollab, 3300 controllers, and all IP deskphones reside. We have never had these ports opened before and this seems excessive, is it necessary? Please see below for details. Any advice you can offer is greatly appreciated.

Server Configuration
1. MiVoice VM Server, MiCollab VM Server, and physical 3300 controllers all located on inside voice network
2. MBG VM Server located in the DMZ

Firewall Configuration
1. Ports have been opened as recommended by Mitel’s documentation
2. Firewall logs do not show any blocked traffic between MBG and MiVoice, MiCollab, and 3300 controllers
3. Have tried opening all ports between MBG and MiVoice/MiCollab/3300 controllers for testing (nothing changed)
4. Ports are opened between the MBG server and other internal servers (MiVoice, MiCollab, 3300 controllers)
5. Ports are *not* opened directly from the MBG server to in-office desk phones (5330e & 6930)

Phone Models
1. A mix of 5330e and 6930 IP phones

What has changed
1. Version upgrades for MiVoice, MiCollab, MBG, and 3300 controllers in late January 2024
2. MiVoice version:  10.1 (Active software load: 10.1.0.29 (21.1.0.30))
3. 3300 Controllers version:  10.1 (Active software load: 10.1.0.29 (21.1.0.30))
4. MiCollab version:  9.7.1.110-01
5. MBG version:  11.5.2.31

What is happening
1. Both 5330e & 6930 teleworker phones can call a 5330e phone that is in the office
2. Both 5330e & 6930 teleworker phones *cannot* call a 6930 phone that is in the office
3. Both 5330e & 6930 in-office phones can call both 5330e & 6930 phones that are teleworkers
     a. Recently, I have began to see dead air when an in-office phone calls a teleworker
     b. This is rare but it has happened a few times
4. MBG event logs show “one-way audio” with “comment:loss of rx stream, from:IS, duration:5963” as description
     a. This event does not always appear when a teleworker calls an in-office phone and gets “dead air”

Observations
1. Seeing the MBG server try to connect with the IP of the internal Mitel phone directly – is this normal behavior?
     a. When a teleworker calls in in-office phone, firewall logs show that the MBG server tries to connect directly with the in-office phone on udp ports 50000 – 50511
     b. If these ports are allowed, the calls succeed
     c. I have never had these ports opened and this has never been an issue until after this version upgrade
2. Calls from a teleworker to an in-office 5330e succeed, even though the firewall logs a failed attempt at a direction connection to the IP of the desk phone
3. Calls from a teleworker to an in-office 6930 fail and the firewall logs a failed attempt at a direction connection to the IP of the desk phone
4. Calls from the MiCollab app on an iPhone to an in-office desk phone always seem to work fine
5. This problem doesn’t appear to affect teleworkers that use the PC softphone but I do not know this for sure
6. Unknown if the problem exists with a teleworker calling an in-office softphone
7. These problems were first noticed about 3 – 4 weeks after the late January version upgrades and seem to be progressively getting worse

[ZuluAlpha]

On the inside if your TW and MBG are trusted it shouldn't be an issue. Is there an external firewall involved? It sounds like it's blocking SIP to the 6900's.

[dmichels79]

Hi ZuluAlpha!

There is a firewall involved. The MBG server resides in the DMZ zone of the firewall, the other Mitel servers and in-office desk phones reside on the inside, corporate lan zone of the firewall. I have opened all ports for testing from MBG to internal servers and vice versa. The only way it seems that teleworker calls succeed is if I allow MBG (DMZ zone) to talk directly to the in-office desk phones (inside zone).

This was not the case prior to the upgrade in January, is this normal behavior that MBG needs to talk directly to the desk phones in the office when I call is initiated from a teleworker?

[johnp]

The 3300 only sets up and tears down the calls, all audio streams from device-device, or perhaps device-teleworker server in your case

[dmichels79]

Thank you johnp!

Am I understanding correctly that call audio from teleworkers inbound through the MBG server should go straight to desk phones that are on the "inside" network of the office, after the call setup and tear down takes place? Has this always been the case? I've never had inbound ports directly from MBG to in-office desk phones open before.

[johnp]

Yes that is how the audio has always been done on the 3300, I think the 250 stays in the middle

[johnp]

FWIW, the audio internally is udp in the 50000 range, but teleworker to remote set goes in the 20000.

[ralph]

Usually when I see this it's because of a routing issue.  That is if the FW is configured correctly.
Is the problem that the TW phones can ~never~ get audio or only when calling devices on certain subnets.
Also, you may want to ensure that the network routing in the TW server know about all of your inside networks, not just the one that he 3300 resides on.

Ralph

[dmichels79]

Hi Ralph,

The TW phones get audio when calling a 5330e phone in the office but not when calling a 6930 phone in the office. This all started after the version upgrade in late January of this year. I haven't seen that the TW phones can get to some phones internally better than others based on their subnet, seems to be more specific to the model of phone.

From what I can see in the MBG server, there are networks specified that covers where our internal phone IP ranges are.