Grandstream Provisioning

[dcitelecom]

I am trying to provision a Grandstream HT/701.
After setting everything up on the fusionpbx side, I opened the Grandstream GUI and entered the config server path, http user name and password.
If I set provisioning to HTTP, it works. HTTPS does not work. We use Let's Encrypt for SSL. Is there some firewall port that needs to be opened?

What makes this even more difficult is that the fusionpbx GUI seems to hardcode HTTPS no matter the setting in
Default Settings -> "grandstream_firmware_upgrade_protocol"

Same thing for "grandstream_accept_sip_from_proxy_only"
No matter the setting, it defaults back to "0"

Does anyone have any experience with this model? Any idea why http provisioning works but https doesn't?

 

[hfoster]

Not Grandstream, but for a while Yealink didn't have the CA of LetsEncrypt pre-installed for a while, so we had to enable insecure TLS. If it's not that (you might be able to tell from a packet capture/log, then it's potentially a problem with the nginx configuration?

 

[whut]

It has been awhile since I last used Grandstream. But here are some memories for the phone's embedded webpages.

set config upgrade path to https (preferred over http)
do not include https:// or https:// in the config server path
you might also set firmware upgrade and provisioning away from 'always check for new f/w' to 'check new f/w only....' or even the last choice of 'skip' to get yourself started.
as you are mentioning f/w protocol turn 'Use Grandstream GAPS' OFF if you have that setting. I found I needed to have this off.

HT701, HT702, and HT704 provisioning templates do not have grandstream_firmware_upgrade_protocol & grandstream_accept_sip_from_proxy_only variables currently. Nor do they have the Pcodes for these variables as I find the variables in other Grandstream provisioning templates, so fusion is not going to touch these settings for your chosen model. Perhaps the provisioning templates need to be updated with a new f/w NOOBs template from the devices.