Remote install of 5330's help.

[gr8whtd0pe]

We are a small company and are new to IP phones. We have 20 or so 5340s inside our network, but are now trying to install phones at remote locations.

We have set the ICP to our public IP address, forwarded all the ports our "Mitel Tech" told us to the controller.. Phones still do not connect.

Any ideas? Teleworkers is set to the public IP as well.

Phone IP: 0.0.0.0
Gateway: 0.0.0.0
Subnet: 0.0.0.0
ICP: public IP of controller
Http proxy: public IP of controller
Proxy port: 100


That's it.

Help?

[acejavelin]

Here is the "official" tech bulletin on what to port forward for IP phones remotely, slightly dated but should still be applicable. https://dl.dropbox.com/u/95033600/Intertel%205000%20NAT%20Port%20Forwarding.pdf there are a wide variety of ports/ranges  you need to open up and map to the 5000's internal IP address.

Remember you need to set the public IP address in the 5000 in TWO places, first in System-IP Settings-System NAT IP Address and secondly in Settings-Devices & Feature Codes-IP Connections-Pxxxx-NAT IP Address. The only other thing you will have to do is go into each endpoint that is remote and under IP Settings of each individual endpoint change the NAT Address Type from Native (or Auto) to NAT. Also, although this won't effect phones connecting, if bandwidth is an issue you might want to use the Remote Call Configuration and apply it to the remote endpoints, basically all this does is force the phones to use G.729 instead of G.711, lowering their bandwidth requirements, and quality slightly, for audio.

Once those are in place, factory default the phone itself, make sure it is on a network that will provide it DHCP and power up and put the phone in Teleworker Mode to the public IP address with the port fowarding to the 5000.

That is it, there is no special magic or trick to make it work... I have connected literally hundreds of phones, both Mitel IP phones and the original Inter-Tel IP endpoints, in this way and had no issues for the most part. Occasionally I have run across routers (or configurations in routers) on the remote end that are too locked down to allow the phones to connect, but this is extemely rare and can usually be corrected by letting the network administrator know what port ranges you are using.

[gr8whtd0pe]

Thanks for the reply. We have done all this, still no connection.

[acejavelin]

OK, so what do you know other than the above? What does the display in the phones tell you? Does it go through the usual boot steps and get to a screen like IP: xx.xx.xx.xx ICP: xx.xx.xx.xx and just sit there or does it give some kind of message? If you take a phone to a different location, does it work? If you put the phone directly on on a public IP address statically does it connect? Do phones connect inside the LAN?

When this fails it, assuming the 5000 is setup correctly, it is almost always a router issue on the 5000 end, with the ports not passing through properly or getting caught in a firewall. What type of routers are at each end?

Remember the phone is essentially just another PC (or node) in the network, all the same troubleshooting rules apply.

You could just try to pull a file manually with a PC and see if that works, using a TFTP client try to retrieve "L2Boot53xxTtn8M.bin" or "BootIp5324Ttn.bin" and see if you can get the file on the proper ports, that is one of the first steps the phone does. You could also just do a Wireshark of a phone booting and see where it is failing.

[gr8whtd0pe]

OK, so what do you know other than the above? What does the display in the phones tell you? Does it go through the usual boot steps and get to a screen like IP: xx.xx.xx.xx ICP: xx.xx.xx.xx and just sit there or does it give some kind of message? If you take a phone to a different location, does it work? If you put the phone directly on on a public IP address statically does it connect? Do phones connect inside the LAN?

They just sit at the IP/ICP screen. When we first installed them in the office it was because they were not talking to the controller (switch issues), so we assume that this is the case. They are getting DHCP from the remote location's router. I have DMZ'd the MAC there and still get the same issue. I don't think it is the routers at the remote locations. If we give it an IP and tell it the controller on the local network (192.168.200.201) then they will connect. Our network is 172.xxx.xxx.xxx so we do not do DHCP for the 192 network.

When this fails it, assuming the 5000 is setup correctly, it is almost always a router issue on the 5000 end, with the ports not passing through properly or getting caught in a firewall. What type of routers are at each end?

Here is a Cisco 2900 series, at the remote locations they are DSL/Cable modem/router combos. Right now we are only testing on the DSL locations since there is one right across the street from us. Funny thing, its that phone company that installed this system and is supposed to be helping with it. They claim there is no ports to open on that end.

Remember the phone is essentially just another PC (or node) in the network, all the same troubleshooting rules apply.

Yup, got that. Just no DHCP.

You could just try to pull a file manually with a PC and see if that works, using a TFTP client try to retrieve "L2Boot53xxTtn8M.bin" or "BootIp5324Ttn.bin" and see if you can get the file on the proper ports, that is one of the first steps the phone does. You could also just do a Wireshark of a phone booting and see where it is failing.

Tried this, timed out. Seems to be a porting issue, but they are all pointed to the 192.168.200.201 which we can access from our 172. network. The gateway for the Mitel 5000 is 192.168.200.1, should we be pointing to that instead?

Also, don't know if it matters or not, but we did all the ports that are listed last on the PDF you linked only.

[acejavelin]

I am sorry, but this seems very confusing... a true DMZ should not be required at all, perhaps there is a little too much going on. Let me see if I get this correct.

Mitel 5000 location:
Data VLAN: 172.x.x.x (irrelevant for this discussion)
Voice VLAN: 192.168.200.x (5000 @ 192.168.200.201, and can access the internet properly)
Cisco 2900 is the primary router, routing between each VLAN and each VLAN's gateway to the Internet (for example, 172.16.0.1 on one interface and 192.168.200.1 on a second interface). Port forwarding is being done from a static public IP address to the Mitel 5000's 192.168.200.201 IP Address.

Assuming this is done, you should be able to take a phone to almost any location in the world, plug it in, throw it in Teleworker mode, and away you go. I do this from home all the time...

Plug in phone, it gets a 10.20.30.xx IP address from my Linksys router (my Linksys has nothing special in it but Tomato firmware, but it worked properly on the stock firmware as well, no programming or setup required, all outbound port access is handled by the embedded NAT handler since the ports are opened originating inside the firewall), throw it in TW mode and put in the public IP address that our Cisco 891 router (24.230.xx.xx) is handling for the Voice VLAN that has the appropriate ports forwarded to the Mitel 5000 at 10.10.10.11 in our network.

Basically, if the phone can connect from ANY remote location, the problem is remote site specific, if the phone can't connect from any location the issue is on the local end... If you have an extra public IP at the local location (or one you can steal for a short time), put a switch between your Internet connection and the main router, put that static IP information in the phone, and try to connect to the system, if it connects through then your router/5000 setup is correct, if it doesn't... well, you get the picture.

[gr8whtd0pe]

I am sorry, but this seems very confusing... a true DMZ should not be required at all, perhaps there is a little too much going on. Let me see if I get this correct.

Mitel 5000 location:
Data VLAN: 172.x.x.x (irrelevant for this discussion)
Voice VLAN: 192.168.200.x (5000 @ 192.168.200.201, and can access the internet properly)
Cisco 2900 is the primary router, routing between each VLAN and each VLAN's gateway to the Internet (for example, 172.16.0.1 on one interface and 192.168.200.1 on a second interface). Port forwarding is being done from a static public IP address to the Mitel 5000's 192.168.200.201 IP Address.

Assuming this is done, you should be able to take a phone to almost any location in the world, plug it in, throw it in Teleworker mode, and away you go. I do this from home all the time...

Plug in phone, it gets a 10.20.30.xx IP address from my Linksys router (my Linksys has nothing special in it but Tomato firmware, but it worked properly on the stock firmware as well, no programming or setup required, all outbound port access is handled by the embedded NAT handler since the ports are opened originating inside the firewall), throw it in TW mode and put in the public IP address that our Cisco 891 router (24.230.xx.xx) is handling for the Voice VLAN that has the appropriate ports forwarded to the Mitel 5000 at 10.10.10.11 in our network.

Basically, if the phone can connect from ANY remote location, the problem is remote site specific, if the phone can't connect from any location the issue is on the local end... If you have an extra public IP at the local location (or one you can steal for a short time), put a switch between your Internet connection and the main router, put that static IP information in the phone, and try to connect to the system, if it connects through then your router/5000 setup is correct, if it doesn't... well, you get the picture.

Forgot to post back that we finally got it working. We have installed a dozen or so phones with no issues. All working great, just 30 to go lol.

We do have one problem child. Its on Comcast. It will connect, really fast actualy, but no audio. Our Mitel tech is usless. Said its our ports even though every other phones (including some on comcast) work perfectly fine.

Ideas?

[acejavelin]

It is still a port issue... but likely not on your end. What are you using for routers on the remote end of the troublesome Comcast sites? is it a Comcast modem-router combo? if so that might be the issue. Also, some areas, especially ones with high density penetration (lots of connections) to the ISP, the ISP will do NAT on their end, and not give a publically addressable IP address, this can cause issues as well although this is not as common as it used to be.

[gr8whtd0pe]

It is still a port issue... but likely not on your end. What are you using for routers on the remote end of the troublesome Comcast sites? is it a Comcast modem-router combo? if so that might be the issue. Also, some areas, especially ones with high density penetration (lots of connections) to the ISP, the ISP will do NAT on their end, and not give a publically addressable IP address, this can cause issues as well although this is not as common as it used to be.

It's only this one location and yes it's a Comcast business gateway modem/router combo. If I dmz the phone I can get one sided audio (they can't hear me, I can hear them) and it actually rings when calling a number. I know it has to be ports, I just don't know which ones.

[acejavelin]

Just request a static, public IP address and put in a decent SoHo router like Asus, Engenius, Linksys or D-Link (pretty much anything but Netgear for the most part) and you should be good to go... You need to get away from those AIO cable/dsl routers, they are bad news for VoIP. My favorite and most stable router is still the Linksys WRT-54GL (must be the GL version) for $50 on Newegg, load it with Tomato firmware and go, I have one that hasn't been rebooted in at least 2 years and has about 20 phones and about as many PCs working flawlessly.

[gr8whtd0pe]

Just request a static, public IP address and put in a decent SoHo router like Asus, Engenius, Linksys or D-Link (pretty much anything but Netgear for the most part) and you should be good to go... You need to get away from those AIO cable/dsl routers, they are bad news for VoIP. My favorite and most stable router is still the Linksys WRT-54GL (must be the GL version) for $50 on Newegg, load it with Tomato firmware and go, I have one that hasn't been rebooted in at least 2 years and has about 20 phones and about as many PCs working flawlessly.

It has a static IP. If you mean replace it with just a modem and no router, it doesn't make sense why other locations with the same excact setup do not work. I assume it has something to do with Comcast in the area. Aparently here they are all the same, but different.

[gr8whtd0pe]

Sigh... Fixed. Over looked it was set to native and not nat.

[acejavelin]

Sigh... Fixed. Over looked it was set to native and not nat.

lol... no problem, glad you got it working, done it myself... let's just say, more than once.