Autoprovision Cisco5xx - Specific Model 504G

[mcs3ss2]

Hi Guys, I need help. Auto Provision is not working.
Manual provision work and no issue making outbound or receiving inbound calls.
Server is hosted in the cloud.

Here is what I have done so for following various threads in this forum.

In Advanced>default settings under provision
Set enabled to true
Set "http_auth_enabled" to true
Set "http_auth_username" username setup
Set "http_auth_password" password is setup

In Accounts>Devices
Add new entry
Enter MAC address of phone
Select a template and saved

In Accounts extensions I have assigned previously added phone/mac to an extension

HTTPS is disabled in Cisco504G

and here is my autoprovision url

http://this.is.my.domain.com/app/provision/?mac=$MA

When I visit the following url

http://this.is.my.domain.com/app/provision/CISCO504GMAC.cfg

I get username and password prompt. When I enter un/pw that I created in default settings the cfg file downloads successfully.

I know I am not far off but I have no clue where to go from here. Please help. Thanks.

 

[ad5ou]

http://username:password@mydomain.com/app/provision...

The username/password above should equal the http_auth_username/password set in default settings.

 

[mcs3ss2]

@ad5ou

Thanks buddy but that did not do it.

Open for suggestions. Or if there is anything that needs to be checked on the server?

 

[Jonathan Black]

Provided that your provisioning template is valid and that device is configured in FusionPBX, it should work. But the syntax is a bit different for the SPA phones. Here's how I provision SPA devices: Determine the IP address (192.168.0.130 in this example), then browse to:
http://192.168.0.130/admin/resync?[--uid user --pwd password]http://mydomain.com/app/provision/?mac=$MA
Replace the IP address with the phone's address, the user/password with yours, and the correct domain name.

However, you have to URL encode the second half of it, so it actually looks like this:

http://192.168.0.130/admin/resync?%5B--uid%20user%20--pwd%20password%5Dhttp%3A%2F%2Fmydomain.com%2Fapp%2Fprovision%2F%3Fmac%3D%24MA

This makes it super simple to do one-click provisioning on these phones.

If it still doesn't work, check your nginx access and error logs to see if the phone is requesting the config file. If it is requesting the file accurately, then verify that the config file doesn't have errors in it. If it does, then your provisioning template may be bad for that device.

Oh, and make sure you are on current firmware on the phone.

 

[mcs3ss2]

How do I go about editing provisioning template? What changes need to be made there?

 

[mcs3ss2]

there is nothing in the access and error logs which indicates the access was blocked

 

[DigitalDaz]

So now use ngrep to check port 80 something like:

ngrep -dany port 80 -W byline

Try and provision the phone and watch ngrep for the requests hitting your box.

The next question is, is this a standard Debian install?

 

[mcs3ss2]

no traffic hits while I monitor sngrep. Firewall is completely OFF and Box is open to the internet.

Debian version is


When I manually configure the Phone



Then I do get a hit on sngrep



Following this when I head over to Provision section of the pbx and click on Provision (of the same SPA504G)


I do get the following hit on sngrep again



Any thoughts please...

 

[mcs3ss2]

In the profile rule I am using this format


I have disabled auth_user and password settings in default settings.


and I can access the the following url in the web browser without any user/pw and config files opens

http://pbx.DOMAIN.net.au/app/provision/CISCO504GMAC.cfg

 

[Jonathan Black]

Check for any activity from that phone in your nginx access.log or error.log. If you are not seeing activity, then the problem is not the provisioning template, but some other issue.

Try the command @DigitalDaz suggested, since that targets http activity. (sngrep targets SIP messages, but in this case we're interested in http.)

Since you can directly access the config file from a browser, try it again in the browser using the format you specified in the Profile Rule:
http://pbx.domain.net.au/app/provision/?mac=CISCO504GMAC

 

[mcs3ss2]

@Jonathan Black @DigitalDaz Thanks for the insight guys

using the following url in Profile Rule

domain.net.au

domain.net.au -

pbx.domain.net.au

there is not activity in ngrep


using the config url in Profile Url

http://pbx.domain.net.au/app/provision/SPA504GMAC.cfg

there is no activity


however when I put this url in browser

domain.net.au

domain.net.au -

pbx.domain.net.au

I get


and activity on ngrep screen



Does this makes sense?

 

[Jonathan Black]

Two things:

• When you add/update the Profile Rule, are you restarting the phone afterwards or otherwise triggering it to provision itself? The resync command I gave you earlier will both set the Profile Rule AND cause the phone to reach out for provisioning.
• Earlier, where I advised you to try this:

  http://pbx.domain.net.au/app/provision/?mac=$MA

  in your browser, make sure that you replace "$MA" with your actual mac address. That is why you are getting the "invalid mac address" message.

 

[mcs3ss2]

When I add/update profile rile, I donot reboot, Should I?

PBX in the the cloud and I amd testing from home (Internet in between me and pbx)

I missed out on rsync command and cannot find it in the above thread, please share again.

Yes i tried
In the browser
and I get the site cannot be reached. Also no activity on ngrep screen

 

[Jonathan Black]

http://192.168.0.130/admin/resync?%5B--uid%20user%20--pwd%20password%5Dhttp%3A%2F%2Fmydomain.com%2Fapp%2Fprovision%2F%3Fmac%3D%24MA

Make sure to replace:

• IP address with your phone's IP
• user with your user
• password with your password
• domain - make sure you leave in the "%3A%2F%2F" before it.

If you want to try it with no user/pw, use this:

http://192.168.0.130/admin/resync?http%3A%2F%2Fmydomain.com%2Fapp%2Fprovision%2F%3Fmac%3D%24MA

If you are getting "site cannot be reached" in your browser, then you did something wrong. Double check the domain and possibly your DNS.

 

[DigitalDaz]

You could possibly have been banned too by fail2ban if its been getting invalid mac address.

 

[mcs3ss2]

so here is what I am using in Resync Trigger 1 profile

http://192.168.100.16/admin/resync?http%3A%2F%2FMYDOMAIN.net.au%2Fapp%2Fprovision%2F%3Fmac%3D%24MA

Profile Rule

http://pbx.domain.net.au/app/provision/?mac=$MA

No Joy, No activity on ngrep

 

[mcs3ss2]

@DigitalDaz
I just checked f2b and I am not blacklisted/banned for the following jails

 

[mcs3ss2]

Hi @DigitalDaz @Jonathan Black and all other colegues

Not working with below settings


But when I changed to following it works every time. The phone auto provision and goes online no problem. I have reset the phone to factory settings many many time, more than I can remember and applied below settings for auto provision and it worked every time.


here is nginx access log

123.456.789.101 - - [19/Mar/2021:00:00:13 +1100] "GET /app/provision/?mac=SPA504GMAC HTTP/1.1" 200 47141 "-" "Cisco/SPA504G-7.6.2g (SPA504GMAC)(NOTSUREWHATTHISIS)"

Here is the nginx access log after provision line above

127.0.0.1 - xCVWHEigwGEzF3T8Y2QUTQAZmcc [19/Mar/2021:00:11:29 +1100] "POST /app/xml_cdr/v_xml_cdr_import.php?uuid=a_8f2aca78-ed71-4ff1-add4-272dd233bc1c HTTP/1.1" 200 5 "-" "freeswitch-xml/1.0"
127.0.0.1 - xCVWHEigwGEzF3T8Y2QUTQAZmcc [19/Mar/2021:00:11:47 +1100] "POST /app/xml_cdr/v_xml_cdr_import.php?uuid=a_f3abca7d-c48f-4cd4-af83-9ff30d20dc63 HTTP/1.1" 200 5 "-" "freeswitch-xml/1.0"
46.219.119.65 - - [19/Mar/2021:00:18:54 +1100] "GET / HTTP/1.1" 301 185 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7"
127.0.0.1 - xCVWHEigwGEzF3T8Y2QUTQAZmcc [19/Mar/2021:00:21:25 +1100] "POST /app/xml_cdr/v_xml_cdr_import.php?uuid=a_0308e166-c78d-4848-8c43-c01f28dae55d HTTP/1.1" 200 5 "-" "freeswitch-xml/1.0"

Moving forward, what effect would this have on call duration? Will the call randomly dropout? I have made 2 phone calls to my mobile, one call dropped out at 8 minutes 56 seconds and second call 9 minutes and 27 seconds. Could the above changes be causing this?

Secondly BLF functionality is not working in PBX Device/Provision section. When I press Provision, the BLF key does not get programmed.

Any thoughts?

 

[mcs3ss2]

Hi,

I have got the BLF working with the following syntex

fnc=blf+sd+cp;sub=101@$PROXY

and direct external call

fnc=sd;ext=NUMBER-WITH-AREACODE

Now if some one can shed some light please, why the calls are dropping? PLEASE

 

[Jonathan Black]

Glad you got the provisioning working! Make sure you re-enable authentication.

I am using 0 in "Resync Periodic". This field is only for if you want the phone to reach out and reprovision automatically every X seconds. In most cases, that's not needed.

But I doubt this is causing the call to drop. That's a different issue and may well be unrelated to provisioning.