Remote extension works locally but fails away from the office

Keep the local baseline

Record the working local account and firmware before moving the phone. If the same endpoint fails remotely, identify what changed: DNS, NAT, firewall, VPN, address family or provisioning access. Do not immediately rotate a secret that was just demonstrated to work.

Compare the advertised and actual media address

Separate registration and media

A remote phone that receives no registration reply needs a signaling-path investigation. A registered phone with one-way sound needs media negotiation and delivery checks. A successful outgoing call with failed incoming delivery can indicate an unreachable stored contact.

Inspect the VPN route if one is used. Split routing or overlapping private subnets can send some PBX traffic to the wrong interface. Public-address workarounds from a non-VPN configuration may no longer fit.

Preserve security boundaries

Use the organization's supported remote-access design and current device guidance. Opening management services to the internet is not required merely because a handset needs calling access. Limit carrier and endpoint traffic according to the actual topology.

Verify persistence

Test incoming, outgoing, hold and transfer, then restart the phone and exercise a controlled network reconnect. Record recovery timing and contact changes. A single call immediately after manual setup does not validate an unattended remote worker's daily operation.