Teleworker Setup

[JasonTL]

I am trying to set up a teleworker phone for the first time. I have read through the Mitels docs and have found several docs to set up the phone itself. I can't find a good guide for the MBG set up of things. Wondering if someone can help me walk through the MBG setup.

I have the phones connected and I have provisioned the teleworker settings. The phone connects to the MBG it seems because it downloads the tftp during boot, but hangs on "contacting server". I have licensing in the MBG and have set the installer password and SIP capabilities. I am just not sure what I am missing.

The PBX in 7.2 and the MBG is 9.2. I am using a 5324 and 5340 IP phone.

[acejavelin]

Where are these phones physically located? If they are inside the local network they may not come online, if they are outside have you ran the Teleworker Network Analyzer to see if all the ports and services are running properly?

[JasonTL]

I have access to try both in network and out of network. I am currently trying from outside the network. I will try to run the analyzer thanks.

[JasonTL]

After running the analyzer tool, all ports are closed except the tftp ports. Is this a setting in the MBG or potentially the company firewall?

[acejavelin]

After running the analyzer tool, all ports are closed except the tftp ports. Is this a setting in the MBG or potentially the company firewall?

Is the MBG in Server-Gateway mode (one NIC on LAN and one on WAN) then it's the MBG...

If it is in the DMZ, then it is probably the firewall of the customer.

[JasonTL]

MBG network profile is running in LAN mode currently. Do I need to switch it to server-gateway mode?

[acejavelin]

MBG network profile is running in LAN mode currently. Do I need to switch it to server-gateway mode?

A MBG needs to be in a true DMZ or in Server-Gateway mode... it is the interface between the public and private networks.

I prefer Server-Gateway mode for physical servers... it requires 2 NIC's, one with it's own static LAN IP, and one with a public, static IP address that is dedicated to it's use.

[JasonTL]

Thanks for the replies. I am going to change it to server-gateway mode this evening and will test again.

[acejavelin]

Thanks for the replies. I am going to change it to server-gateway mode this evening and will test again.

Sounds good...

Just remember this requires a reconfiguration (have to putty to the server and use the configuration tool) and two physical network connections, one on the LAN or Voice VLAN, and one directly on the public internet and not through a firewall or router.

For example:

LAN IP: 192.168.1.10
WAN IP: 21.123.234.12

The MBG becomes the firewall/router for that connection.

[JasonTL]

I am using a VM server and not actually physical. Would the DMZ option be better suited for a VM?

[acejavelin]

I am using a VM server and not actually physical. Would the DMZ option be better suited for a VM?

All depends on the customer and their IT support... Mitel fully supports Server-Gateway or Server-Only DMZ configuration in a virtual environment (and maybe LAN only, but I have never used this configuration on any MBG)

I prefer to still use Server-Gateway mode if possible, but this requires bringing a public VLAN into the VMWare environment and assign it to a second virtual NIC on the VM.

For example: Voice VLAN 6 is on NIC1 and Public VLAN666 is on NIC2, you setup the static's like a normal physical server. This is the cleanest and easiest from our perspective because we don't have to deal with an external firewall.

Problem with this is some IT support people frown on putting a public VLAN into their Vsphere environment and you have to run it that way for "security" concerns (which there are none if it's properly configured, the MGB firewall is better than anything they might have). 

[JasonTL]

Tested after hours yesterday and it seems to have worked. I connected from an outside network and the phone worked. A couple questions. It did not prompt me for the teleworker password even though I have the installer password set in the MBG and it also did not use a teleworker license. This phone had been used inside the network before, did it recognize that as a phone already in use or am I missing something else?

Thank you very much for your info and help!

[JasonTL]

I may have spoken too soon. We had one way audio this morning in server-gateway mode. I had to change it back to LAN mode to get the internal phones working correctly again.

[acejavelin]

Tested after hours yesterday and it seems to have worked. I connected from an outside network and the phone worked. A couple questions. It did not prompt me for the teleworker password even though I have the installer password set in the MBG and it also did not use a teleworker license. This phone had been used inside the network before, did it recognize that as a phone already in use or am I missing something else?

Thank you very much for your info and help!

If the MAC address is known to the MBG, it won't prompt you for the password. Seems odd it didn't use a TW license though. Are you sure the public IP address is directly connected to the WAN interface of the MBG?

I may have spoken too soon. We had one way audio this morning in server-gateway mode. I had to change it back to LAN mode to get the internal phones working correctly again.

You had one-way audio on internal phones in Server-Gateway mode? Odd, the internal interface of the device is the same as a single interface LAN mode. I assume you are using this for SRC?

I don't have much to help you with at this point... In server-gateway mode, it is as basic as it gets, the voice VLAN and a static IP on the internal NIC and the WAN and a public IP on the external IP. Without getting deeper into the configuration of the network and your application I am not sure what else I can say.

[VinceWhirlwind]

On the controller, put the MBG in a different "Zone" from the phones.