Provisioning issues with the firewall

How do files get FTP’d exactly? IT guys are wanting to make a rule to allow configs to be pushed to phones, but they’re seeing random port numbers each time and its UDP traffic. Is the server starting a conversation with the phone on a random port before actually sending a file?

Also having problems with HTTPS provisioning on any phone (not just in the office). I cant get the phone to actually pull a config when putting the string into the phone manually, nor can I get the PBX to push a file. Actually, the first time I tried pushing a file from EPM it FTP’d the file but loaded the HTTPS string into the phone. I assumed it was a firewall issue but even turning the firewall off completely doesnt change anything.

I also tried putting the string in as a custom destination in the template. No change.

Provisioning protocols

PBX Version: 16.0.40.11

PBX Distro: 12.7.8-2306-1.sng7

Asterisk Version: 18.20.2

I think I answered my own question RE HTTPS. It’s a yealink issue most likely. HTTP works OK.

As for FTP, I think I confirmed that the phone system is listening on port 21 and using TCP, but i’m wondering how (or if it’s a terrible idea) to force all configs sent out to come from the same port number.

netstat -tlnp | grep :21

tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN 12661/vsftpd

iptables -L -n | grep :21

ACCEPT tcp – 0.0.0.0/0 0.0.0.0/0 tcp dpt:21

1 Like

So I got the port set in the vsftpd.conf file but they’re not seeing much. When I try and push a config from the EPM the phone reaches out to some IP (35.something) that I’m not sure about. Tried downloading a .rom file direct from Yealink and loading it into the phone after a factory reset, and no change. Not sure where to get a factory .BIN file. Even shut off the firewall on the pbx entirely but no change there either. Are the phones compromised?

Phone calls work fine, but pushing config files does not.

The 35 IP address is a different PBX and it’s coming from the DHCP options on the router. Phones can reach out for a file now, so this will likely turn out to be a router issue. Still curious how FTP works, does it first send a message to the phone to tell it pull a file rather than just pushing a file?