Mitel decrypt error

[cdcirexx]

Hi all,

we have a open ticket with TAC, but wanted to ask if anyone's seen this, we're in the testing phase of it, and one of the phone's traffic shows up in the logs as decrypt error in the end result, so that phone is not able to login to the mitel portal, tac also disabled the user-id policy to narrow it down(I have tried to add a app override already, but haven't tried to disable alg. They're in the process of researching it, but we have a deadline coming up.

thanks in advanced.

[OtakarKlier]

Hello,

I would say bypass decryption since the device is having issues with the certificates.

Regards,

[shawnhafen]

Here to echo what @OtakarKlier  said. We use the same shoretel/mitel phones and the zone they are in does not get decrypted. To take it a bit further you can use NAC to make sure only phones are on that vLAN too.

[cdcirexx]

Thanks for the reply, we tried to bypass decryption, but that didn't work, we're now have other issues on our phones, like we can't get to voicemail, I'm trying to work with tac, but the engr seems to be not sure of what's happening.

[cdcirexx]

So basically we can get the phones to call in and out but some buttons like the user directory or voicemail has issues, it will say connection failed or connection to server lost when pushing some of those buttons, we're not doing any decryption at this time. Waiting on TAC to follow up, their supposed to run packet captures.

[jbentivoglio]

Was TAC able to solve this? I have some of the same issues, like connection to server lost.

[cdcirexx]

Nope, I've had an open ticket for a month now, TAC has been puzzled by this, even after looking at packet caps, they had me upgrade to pan-os9, they're starting to think nothing's wrong with the firewall and could be something misconfigured or on the mitel side.

[ehacker1]

Does anyone have a resolution to this?  I just started having this same issue out of the blue with Mitel IP phones... services such as voicemail, recent calls, and phone status changes are not working and new phones won't grab the configuration.  I'm not doing decryption.  If I place the phone physically outside of the firewall, it works fine.

[cdcirexx]

Hi there,

What I did was app override for the ports on the mitel, and also under file blocking I created an allow rule for the mitel app to update