Can't get hints to authenticate

I’m setting up a new freepbx distro and install and i’m most of the way. The only problem i’m having is getting blf working on my cisco phones. I’m trying to get them to show an open/closed button using a time condition although I have also tried a voicemail speeddial as well and using the following in the XML file:

<line button="2">
<featureID>21</featureID>
<featureLabel>Closed</featureLabel>
<speedDialNumber>*271</speedDialNumber>
</line>

I can see them attempt to subscribe to the hint but it refuses to authenticate. I see the following in the log:

Creating new subscription
Sending to 192.168.1.20:50755 (no NAT)
No matching peer for '*271' from '192.168.1.20:50755'
[2016-10-20 14:07:47] NOTICE[19290]: chan_sip.c:31918 handle_request_subscribe: Failed to authenticate device <sip:*[email protected]>;tag=0c1167222c4800064cf57ac2-30d42f4e for SUBSCRIBE

<--- Transmitting (no NAT) to 192.168.1.20:50755 --->
SIP/2.0 403 Forbidden
Via: SIP/2.0/TCP 192.168.1.20:50755;branch=z9hG4bK5db77dd4;received=192.168.1.20
From: <sip:*[email protected]>;tag=0c1167222c4800064cf57ac2-30d42f4e
To: <sip:*[email protected]>;tag=as5c0ed065
Call-ID: [email protected]
CSeq: 1001 SUBSCRIBE
Server: FPBX-13.0.188.9(13.10.0)
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REFER, SUBSCRIBE, NOTIFY, INFO, PUBLISH, MESSAGE
Supported: replaces,timer
Content-Length: 0

I can see the hint in the cli:

*271@timeconditions-: Custom:TC1 State:Idle Presence:Not_Set Watchers 0

What have I missed to allow my phones to authenticate on hints? They only ever show offline. This is on a cisco 8841.