Table of Contents
Blog and Rants
A place to share and reference rants, thoughts, musing and emails to help our customers. Actual customer names, IP addresses, etc may be edited to protect the innocent and/or guilty.
VPN vs Hybrid/Hosted
A Hello Hub is a happy little PBX sitting behind your firewall, chattering with all your phones and providing upstream connection aggregation as needed for phone calls in and out of your network. It's an awesome solution for most of our target customers. But sometimes, business needs grow (or were larger to start with) and you want to connect phones and people outside of your office. This requires either port forwarding on a good firewall that does it well, a properly configured VPN (good routing, not NAT) or what is becoming more and more the solution as carriers, ISP's and firewall needs change: A Hosted Hello Hub system.
We are currently setting up two styles of hosted Hello Hub systems:
- Pure Hosted - Hello Hub/PBX in the “cloud” and manually configured phones
- Hybrid Hosted - A Hosted Hello Hub that handles the VoIP traffic, and a “child” Hello Hub at one or more sites that handles phone configurations.
This solves a wide range of firewall/NAT/Carrier issues, we host the Hello Hub at a Network Operations Center closest to your primary user base (the most users) with excellent connectivity to our back end. We charge $29.95 per month to host a system, for up to 50 extensions. Compare that to the $25-40 per month per phone charges of our competitors, ring-u is significantly cheaper and provides a unique set of features that allow you to manage your phone system.
Want more info: Talk to a senior tech at ring-u: +1 423 456-6700
Polycom Dial Map Woes
Many Polycom phones can not dial internal 3 digit numbers that start with 10 or 11 due their Dial Map. It's the rules that say what you can and can not dial. You can change this via the Web Interface under Settings→SIP. It should look like the image on the right.
Original default test:
[2-9]11|0T|011xxx.T|[0-1][2-9]xxxxxxxxx|[2-9]xxxxxxxxx|[2-9]xxxT|**x.T|+x.T
New version, 1 character different:
[2-9]11|0T|011xxx.T|[0-1][2-9]xxxxxxxxx|[2-9]xxxxxxxxx|[0-9]xxxT|**x.T|+x.T
DHCP Required
By design, the Hello Hub needs a DHCP server to tell it how to live within your network and firewall. There is not way to effectively assign it a static address. Luckily, in 2019 this is how everything is done. Well. Most things anyway.
Below is a slightly edited version of one of those times.
The Letter
Chad,
The ring-u Hello Hub requires DHCP to properly live on your network. It has a backup static address of 192.168.99.9, without a router, DNS and a gateway out, it's only used for emergencies, and in the almost 3 years of ring-u, that's only been a couple of times. In other words, it can't be used for the phone system.
Every other customer has had a DHCP server that assigns addresses to various devices. Modern DHCP servers are an excellent way to reserve an address for consistent addressing (and we recommend it at Reliability and Stability). As the Hello Hub is, like many devices, a Linux based system, technically there are ways to assign an address by editing a text file on the system, the next system update would overwrite those configs. Essentially: the configs for the many outweigh the configs of the few. Other “smart” devices like Chromecasts, Alexa's, Doorbells, Thermostats etc.. expect a DHCP server as well. Sometimes there are ways to circumvent that, but the added threat/attack surface of such an interface is a problem for us. I'm an old network guy, I like on-device manual IP addressing for some things, but I'm afraid this is not going to be one of those cases. You will need a DHCP server, with at least one available address for the Hello Hub. If you'd like to yell at me personally for that, I'm that guy and I'm available. Extension 122 or my mobile: 423-xxx-xxxx
Port Forwarding Geek Out
This is the version of an email sent out about once a week it seems. It was the reason I started the Blog portion of the wiki. It's less formal but a much more conversational mode of information exchange. I hope it helps answer some questions.
The email
Eric, Brad,
I'm the “chief geek” at ring-u, figured I'd jump in directly and help. I'm apologizing in advance for the “geek-out”…
Just to make sure this is needed: External Port Forwarding is only needed if you are trying to use external phones (phones outside of your internal network).
For our typical customers, a simple port forward is “reaching for the stars” and solves their needs with a minimal security risk. The Hello Hub itself has a good adaptive firewall that blocks IP's on failed login and communications attempts. If you are curious, a list of these is maintained and updated in real time: https://portal.ring-u.com/portal/dashboard/noc - You may notice most of this is ipV4 addresses, we do see scans from and block IPv6, but they rarely make the hit list you'll see there.
It's possible to limit the external IP for ports 5060 and 5061, but you may have to change those if the upstream VoIP servers change (happens rarely but possible). Ports 10,000-20,000 source addresses change for almost every call. You (and us) would have to maintain a “whitelist” of every VoIP/Telecom provider endpoint. It's a big list.
When using external phones (a mobile phone with an “App” on it or a physical phone) they may connect from just about anywhere on the planet. We have customers using remote phones on other continents. Even locally, this is a wide range of addresses.
Lets go to serious paranoid geek mode:
Option #1: VPN
Use a VPN. OpenVPN specifically (I use it a lot) works very well. The office Hello Hub will not need ports forwarded to it. The fun part is: Now you have a VPN to manage, all endpoints will need a VPN client, and you need a VPN Server, probably a part of your firewall. That's a decent amount of work, unless you need it for other things as well. This solution also works well for remote offices with multiple phones.
Option #2: Hybrid
We setup a hybrid cloud system. the Hello Hub on-site manages the local phones, and the main PBX is hosted. We charge $25 per month for that hosted PBX, but we don't charge per phone connected to it. All phones, even the external ones, use the hosted PBX for VoIP traffic, no port forwarding is required. Caveat: like all hosted system each phone is constantly communicating to the cloud system and there may be noticeable (but extremely minor) differences.
Option #3: 2nd Net
Consider the phone network “untrusted” (not a bad idea anyway) and put it on it's own internal network. We have a lot of customers that do this using the “Opt” or “DMZ” or other assignable ports on their firewall/gateway.
Option #4: Why?
Re-assess the need for full on VoIP external phones instead of just call forwards to cell phones.
Clues of network issues
Sometimes it takes experienced eyes on the ground. This is a slightly edited copy of an email sent this morning (3/31/2021) after several hours of strange network behavior troubleshooting. I hope to update this soon.
The email
Ada, Sarah, James,
The really curious strange issue was not being able to dial out from 2 different phones at James's location and/or extension 101. We tried several things, including changing his extension number and moving that phone to a different location and ethernet cable.
I made it work by changing his “transport” from UDP (Unidirectional) which is the standard, to TCP. While it works, it's indicative of issues with your network / firewall configuration and or the use of range extenders or bad ethernet switches. Your network is not very large, but it may be more than the ethernet switch and Netgear firewall at that location can handle. It's time for a checkup visit from a decent business network technician and possibly some wiring checks.
My #2 indicator is the ping time to the phones at James's desk. More than 1ms for a physical ethernet cable to a good phone like his GXP2170 or GRP2614 is a sign of poor cabling or equipment. You may note that the ping times to the other phones at that location are all under 1ms.
If I/we can assist a network technician, we are more than willing and able. There is a level of skill and awareness of conditions that an experienced tech can do on site that we can not achieve from remote.
Summary of all of this: It's time for a checkup from a network/IT professional.
The image below is a display from the tool that scans the network, finds and configures phones and is available on your customer web portal at: https://portal.ring-u.com
Poly / Polycom VVX factory reset
Got a Polycom VVX series phone that no-one remembers the password to? In theory, the following instructions will do a factory reset, and then the default password of 456 should work again.
Just in case that link, and the video goes away:
The procedure:
This procedure works for all VVX phones up to the VVX 601 series. It describes and demonstrates the following steps:
- Locate (find) and document your phone's MAC address (alpha numeric number, usually above the bar code on the back of the phone)
- Unplug the power cable from the phone to turn it off.
- If there are multiple cables, the power cable will connect to the AC adapter port.
- If there is only one cable, you have a Power Over Ethernet Network cable, and you should unplug this to turn off the phone. It is recommended not ‘unplugging all cables’. Not seeing a wire in the AC Adapter port would indicate POE.
- Plug back in the AC Adapter or Power Over Ethernet Network Cable to initiate power to the device.
- Return the device back to the standing, up-right position.
- When a Cancel button appears in the lower right hand corner of your screen, press Cancel
- A count-down will begin. Before the countdown has ended, simultaneously hold down the numeric keys 1, 3, and 5.
- The VVX will ask for a password. This will be the MAC address you wrote down earlier. Enter the MAC address, use the dial keys. There are two typing modes on the VVX. The third button from the right will be labeled 1→Aa (one, arrow, capital A, lowercase A). The first character is the current keypad output. Therefore, in this mode, numbers will be entered from pressing the corresponding dial keys. (not actually the left-most) left button with label, yes. But, not the left most button, that one is blank at this state. the button will be labeled with 1→Aa. the first character is the current method of keypad output. Therefore, numbers will be entered from pressing the corresponding keys. Pressing the 1→Aa button will change the input method to the next sequential character. In this case, one press of this button will change the Keypad output to ‘capital letters’ (A→a1). Each press of the key will enter the letter assigned to that specific key. For example, to produce an “F”, the 3-key would need to be pressed three-times. To produce a “T”, the 8-key must be press only once. Please note, that you should offer a 3-second pause before moving on to the next character in the MAC. If the character is repeated, like FF, then press the 3-key three times, pause for 3 seconds, then press 3-key three times again. This pause allowed the cursor to move to the next position. Pressing the typing mode button will change the output method to the next sequential character. In this case, pressing this button once will change the keypad output to capital letters, and the button will read Capital A, arrow, lowercase A, one (A→a1). Press again to type in lowercase letters. When entering the MAC address, please enter all letters in lowercase. Because each key has multiple letters assigned to it, you need to press the key the number of times corresponding to the placement of the letter. For example, if you want to type the letter “F”, the 3-key would need to be pressed three-times. To type a “T”, the 8-key must be pressed only once. Please note that if a character is repeated, such as FF, you should pause for 3 seconds before typing the second character. This pause allows the cursor to move to the next position. The letters and numbers you type in will only appear on screen as asterisks, so this may take a few tries. However, on phones with a directional pad, such as the 101 through 411, the left arrow key will act as a delete key, should you make a mistake. On touchscreen models (500 through 601), the volume down key can act as a delete key. The data entered is masked by asterisks (*) and will not show the characters entered. Therefore the MAC should be entered slowly and concise to ensure the MAC is entered correctly without needing to restart the process. However, on phones with a directional pad (300, 310, 400, 410, 411), the left arrow key will act as a ‘delete’ key, should you make a mistake. On touchscreen models (500, 501, 600, 601), the volume down (-) key can act as a delete key.
- Once complete, press OK.
- The phone will either prompt Configuration Reset or Incorrect Password. If you see Incorrect Password, re-enter the password. If you see Configuration Reset, do not press any keys. The phone will begin its factory reset.
- After the reset, you can reprogram your phone, including its password. Please refer to the instructions for your individual VVX phone model for this. Once complete, press the OK key.
* The phone will either prompt “Configuration Reset” or “Invalid Password”.
Network Growing Pains
Dear E.
You've been with us a long time, we have seen each others businesses grow. I have respect and admiration for the journey you have made. It's time for a technology reality check.
Your network at your new location is lacking. Lets start with our Reliability and Stability basics. You are using your cable company router for main phone system network, it is providing DHCP (Addresses for devices) and all NAT (Network Address Translation) and firewalling for all of your phones and some other devices, plus the network behind the SonicWall that most of your office is on. You can't manage the cable router, you can't reserve an address for your Hello Hub specifically, so every time there is a glitch, reboot or power outage, everything gets new addresses. This is the number one reason some phones have to be reconfigured constantly. The Hello Hub must find the phones and configure them constantly. This device is also simply overloaded providing NAT and services to 80+ devices.
At the physical level, you seem to have network connection problems at specific locations. You have tried swapping phones and ethernet cables to the wall jack, and the same locations often need a phone reboot, to get an address and join the network again. This is symptomatic of physical wiring or ethernet switch problems. It could be something like: ethernet cables wrapped around/over building wiring that causes a problem when the florescent lights go on and off or a “switching loop”.
My recommendations:
You need a good network tech. That person will want to:
- Put your cable modem in “bridge” aka “public IP mode” - At no point should you be “double-natted” like you are now.
- Install a modern business grade firewall/router capable of handling your traffic. I recommend Ubiquiti equipment a lot, current Sonicwall and other gear would also work. Specifically, you have grown past commodity consumer or pro-sumer equipment. Your tech should have experience and knowledge with the product they recommend.
- Test and repair your existing cabling. We see a lot of variability of ping times, indicative of poor wiring. I use a slightly older version of Fluke Cable Testers but I've installed thousands of drops in my past, Your network tech should have an actual tester, not just plug things in and say 'works for me'.
- Evaluate your network switches. They might be fine, you might need some upgrades. It might be as simple as noticing that you have what is called a “switching loop” and relocating some cables.
- WiFi AP's.. Your network tech should have experience with and recommend business grade high density WiFi Access points. Again, I like Ubiquiti WiFi, but Cisco and other vendors provide solid WiFi AP's. These should be wired back to your main ethernet switch. In no case should a real business use “mesh” or “repeater” technologies. Good campus/business WiFi AP's provide coverage as a team, over wide areas, with seamless hand-off. Using your overloaded cable company router for WiFi is the main problem with your WiFi phones.
Respectfully Submitted, –Mike Harrison– Chief Technologist at ring-u.com and an old experienced network geek.
OPENVPN on Grandstream Phones
Bluntly, this is rocket science. We don't do this unless under duress. Example: your country that a remote office is blocking all non-encrypted traffic and we like you enough to setup OpenVPN as a server on a hosted/cloud Hello Hub. We'll create the OpenVPN server and configure it. This is a low to moderate security VPN. It's primary purpose is to punch through firewall/traffic restrictions, not to protect you from the NSA, KGB or other nation state level actors.
Step 1 - OpenVPN
The client/user will need to take the three files we provide and login in to their phones using a web browser. We can not provide or configure them via our automated systems.
We'll send you the three files.
ca.crt is uploaded to “OpenVPN CA”
phone01.crt is uploaded to “OpenVPN Certificate”
phone01.key is uploaded to “OpenVPN Client Key”
The server address is the ipV4 address of your cloud/hosted Hello Hub. The IP in the image is an example.
The port will probably 5042 - an atypical port for either VPN's or VoIP/SIP.
The Cipher method is AES-256
No username or password is required.
Click Save and Apply reboot and pray.
Step 2 - Account Mods
Under Accounts→Account 1 Set the SIP Server IP Address and Outbound Proxy IP address to 10.42.42.1 This is both the Hello Hub and VPN Server Address.
Disclaimer
Depending on too many factors to explain, this may still not work. But so far is getting phones working behind very restrictive nation state firewalls to Hosted/Cloud Hello Hubs
30 second VoIP/SIP call drops
An edited copy of an email I just sent regarding calls dropping at 30 seconds, sometimes.
Re: 30 second call drop issue:
It's a common bug in some older commodity routers that all borrowed the same core firmware years ago. We don't see it as often as we used to, but we still do. You've got a good router on that site, I doubt that's got that glitch, but that's why we start there. Worth knowing, that problem is consistent if it exists, every call, at exactly 30 seconds (maybe 32).
Other devices will drop a call at about 30 seconds, for different reasons, intermittently. WiFi AP's especially if the phones are WiFi. They sometimes have connection tracking limits or are just overloaded. Then there are two things that just completely futz up a network we run into: Sonos WiFi speakers and Mesh WiFi repeaters (Orbi, Google Mesh AP). The WiFi meshes and repeaters often cause “loops” and break all connections and reset for just a moment when they do, or the ethernet switch involved detects the loop and resets.
I'd start with the basics and work up:
Do calls from 1 extension onsite to another break at 30 seconds? If so, that path/traffic is from phone to hello Hub to phone. I'd look at local networking gear. Maybe even a specific phone or ethernet connection.
If that's OK, is it calls to/from landlines (POTS or VoIP) or mobiles? Just one call, or do all calls happening at the same time drop? If all, something upstream from the Hello Hub is breaking the connection: ethernet switch→router→modem→ISP's gear….
I checked out his system last night while checking a problem with fax connections. It looked good but I noticed it was missing some audio prompts when I made test calls (002 and 000) so I sent it an updated sound files (a zip). Transfer speed was < 400KB/s. Took over 10 minutes to transfer. I just did it to my home system, sent 252MB in 8 seconds… 28MB/S – This is probably an indicator of not a great ISP/network connection at . I'd be curious to know what kind of speeds to get from a speed test and what you are paying your ISP for. This was about 10:30pm last night, in case that helps. Maybe you were doing a massive backup/download?
And to test again: I called this morning, two-way audio test ( dial 002 ) sounded great, and I also listened to hold music for about 3 minutes, also sounded great. I also just sent the sounds.zip (252MB) to the system and it took 30 seconds, at 8MB/s. - That's a big difference from last night. is there something variable in the network.ISP, or behavior (downloads, etc..). Maybe that's a clue?
In summary: I'd start with logging the 30 second call problem: What phone, to/from what caller. My assumption is they are outside callers. Are they calling while driving down the road? Or are these solid calls to a fixed location that drop. How was the audio quality of the call before the drop?
Diving into deep diagnostics mode: With the external phone numbers involved and an approximate time and if I get it within 48 hours, I can grab switch logs and see which end dropped the call. If the other parties are dropping, not much I can do but identify it. If the Hello Hub side drops the call, it may be something we can find and address.
–Mike–
Less than FAQ
Modern tech assumes most people learn through playing around. My “smart” TV is always updating and moving things around. So is my mobile phone (Just upgraded to Android 12) and in an age where electronics are complex and often personalized by the end user, this has become the new normal. Ring-u has tried to minimize this, but bluntly, we work with a lot of different phones, and different user configurations but it still happens. Changes are made.
This is an attempt to answer a lot of “less that frequently asked questions” that were just submitted by a customer. Figuring if we are going to answer them, lets try to do it in a place we can share the questions and answers.
The answers apply to a customer using an on-site Hello Hub and GRP-2614's and are rephrased to expand on assumptions.
DND
Q: If using the Do Not Disturb feature on the phones, will the incoming call be routed to another phone, or go to voicemail?“
A: That depends on the settings for that extension under the “Basic” tab labeled “If No Answer, Unavailable”. If the DND setting is set on the phone, the system does what is in that selection.
Q: Is it better to not use Do Not Disturb and just have the caller automatically go to voicemail as if no one answered the call?
A: Personal Choice. “Better” is subjective in this case and depends on your expectations of caller reaction.
Q: In the customer portal at portal.ring-u.com: Extensions 🡪 Basic 🡪 If No Answer/Unavailable What is the difference between Voicemail / Voicemail then hang up / Voicemail then return?
A: “Return” returns the caller to the menu or receptionist or phone they were at before going to voicemail, the hang up option, hangs up on them after they leave a voicemail.
Q: Is there anyway to set the phone to receive internal calls while sending external calls to Do Not Disturb?
A: Not currently.
Q: Will the caller be displayed on your phone’s LED if Do Not Disturb is engaged and allow you to answer the call?
A: On a GRP2614, they will display as a “last missed call” but you do not have an option to answer before the call is routed to the “unavailable” behavior you have selected.
Misc.
Q: Can you set a different ringtone for an internal call versus outside call?
A: The option under the “Advanced” tab labelled: Internal Call Ring Tone provides selection of 3 ring tones for most Grandstream Phones. Some models have more options available internally, but 3 work for all.
Q: At the present time, all phones have Park 600 / Slot 1 601 / Slot 2 602 / and the extensions active in the phone system. What other features should be added to the MPK?
A: We lay awake at night wondering the same. The system will manage the first MPK's, you can easily add more functional MPK's by pressing down on the key for several seconds. If you would like to manage your own completely, you can tell the system to not provide MPK configurations under the “Tricks” menu item.
Q; How do you pick up a call that is ringing at any other extension?
A: 999 or 9 + the extension ringing. This is displayed on the “Dashboard” as well as a list on Useful Codes
Q: Can an extension forward calls of a different extension? (Can Linda’s phone forward Jeff’s phone to her?)
A: Either by using the customer portal and setting the “If Unavailable” option for Jeffs phone, or by selecting “ForwardAll” on Jeffs phone.
Q: There is an option in voicemail to record only your name … what does this option do? When callers are asked to leave a message, the phone system mentions the extension number not the name.
A: If you don't have an “unavailable message” but have recorded your name, it says: “Name” is unavailable… instead of the extension number.
Q: Feature Changes via Phone Extension versus ring-u.com portal … Do you need to check the Disable Auto Config <ring-u.com 🡪 Extensions 🡪 Advanced 🡪 Disable Auto Config> in order for the changes made on the extensions via the phone are not overwritten?
A: Yes.
Q: What features on the WP820 need to be set in order for the phone to function best?
A: If in a factory default configuration, plus manually added to good WiFi, the WP820 is best configured automatically by the Hello Hub. The primary variable is sane good WiFi. Do not use Mesh/Repeaters. Do not mix Sonos or other WiFi speaker systems that swamp the WiFi with chatter.
Virtual Extensions and SoftPhones
Worthy of an entire page and discussion… but the basics:
Q: Can Jeff’s cellphone be setup as a Hello Hub extension so that callers do not see Jeff’s cell number? If so … what are the steps?
A: If you want to call out, using your mobile as an extension on the office system, use a softphone app such as Zoiper or Grandstream WAVE on your phone. Instructions start at: External / Remote Phones. We suggest you start with WAVE. Grandstream Wave Configuration
Fire Alarms over VoIP
Ring-u is not a wireline carrier certified for fire alarm use, is not suitable for file alarm use and specifically does not accept the liability of fire alarms.
Fire alarms have existed before what most of us would recognize as telephones. They use a wide variety of methods of signaling that are often not compatible with VoIP (Voice over Internet Protocol). In the cases they do work with/over a VoIP provider, the provider should be certified for such use, and typically provides the physical connection to the premise, fiber, cable, or DSL with battery backup at the premise and at nearby connection points. Ring-u depends on those systems, but is not in control of them. If you need a real fire alarm system, we recommend a traditional POTS (2 wire analog) phone system with a cellular/mobile backup.
Also be wary of arcane legacy systems to work via Caller ID or FSK (Frequency Shift Keying) to identify a fire alarm call over VoIP. On VoIP systems, clients often alter Caller ID (the calling/originating phone number) causing the alarm to fail, and FSK is just plain not reliably VoIP compatible. Retrofitting systems with modern communications modules without a complete replacement is often possible, contact your alarm company.
NFPA
For most commercial spaces, fire alarm monitoring systems still operate using phone lines. The National Fire Protection Association (NFPA) requires all commercial fire alarm monitoring services to have at least two communication lines connected to the panel. This measure ensures that if one line is busy, the other line can get the emergency message out.
Updated NFPA code allows businesses to have one line connected to a traditional phone cable. The other can connect to a managed, facilities-based voice network. These two lines assure that signals will still be received should one line of communication go down.
Using an analog adapter such as an Grandstream HT802 or Cisco ATA 191 with ring-u may work as a second connection (requires testing, many systems will not work reliably over VoIP), but bluntly using a cellular/mobile phone adapter is a better choice. Most modern fire alarm panels offer a reasonably priced ($100-$500) adapter that works with a small monthly or annual charge for monitoring. Using an ATA (Analog Telephone Adapter) for VoIP is external to the fire alarm system, and requires the adapter, network and internet connection to be powered up and working: a lot of dependencies. In comparison a cellular/mobile connection is typically internal to the fire alarm system, powered by the same battery in case of power outage, and communicates to a nearby tower with redundancies (power and connections).
Stuck? Doing Fire Alarm over VoIP anyway?
These are hints, every alarm system, monitoring company and ATA combination will vary:
- The ATA DTMF method should probably be set to “IN-Audio”
- Disable DTMF negotiation
- Disable Echo Cancellation
- Use the VOCODER Codec often referred to as: PCMU which uses G.711U
- Voice frames per second for TX/Transmit should be 10. ie: 10 frames per second
- Adjust Transmit Gain and Receive Gain: on a Grandstream HT802, -4 to -6 has been reported to work.
- Test, test and test again. Running arcane analog signals converted to digital on a daisy chain of gear that requires on premise power, network and internet connections for a fire alarm is scary.
These confiurations, and possibly many more, should be performed with an on-site alarm technician, experienced in using and configuring VoIP ATA's. Ring-u will not knowingly assist in doing this.
For fun:
The image below is an ancient clockwork “Morse code” style Grinnell fire alarm that predates common telephone use. These were wired in series, daisy chain style, and when the alarm went off it range the bells in different patterns. Firemen would look up the ring pattern (short, short, long, short… for example) to know where to go. The “key” (Morse code style) was used for on-site signalling like “All Clear” or “Send Help”. Picture taken by our “head geek” of a scrapper friends found fire alarm.
