Extension Mobility lets a user log in to any desk phone in the organisation and have it become their phone. Their directory number, speed dials, line appearances and message waiting indicator all follow them.
It’s the feature that makes hot-desking work, and it’s also the feature most likely to generate a support call the morning after you configure it, because a login failure gives the user a numeric error code and nothing else.
This guide covers the configuration and, more usefully, what each of those error codes actually means.
The steps below are based on current Unified CM releases. The menu paths have been stable for several versions, though the exact wording varies slightly between builds.
The configuration checklist
- Activate the Cisco Extension Mobility service
- Set the phone URL enterprise parameters
- Create the Extension Mobility phone service
- Create device profiles for users
- Associate the device profile to the user
- Subscribe phones and device profiles to the service
- Enable Extension Mobility on each phone
Step 7 is the one people skip, and it’s the cause of the most common login error.
Step 1: Activate the Extension Mobility service
The service isn’t activated by default.
Cisco Unified Serviceability → Tools → Service Activation
Activate Cisco Extension Mobility, then confirm it’s running:
Tools → Control Center – Feature Services
Activate it on every node that will handle Extension Mobility requests, not just the publisher.
While you’re there, confirm Cisco Tomcat is running under Control Center – Network Services. Extension Mobility runs on Tomcat, and if Tomcat is down the phone reports Host not found rather than anything mentioning Extension Mobility.
You don’t need every service in the list activated. Plenty of them will show Not Running and Deactivated on a normal cluster, and that’s expected. The only one this feature needs is Cisco Extension Mobility itself.
Step 2: Set the phone URL parameters
System → Enterprise Parameters → Phone URL Parameters
These define the URLs phones use for services including Extension Mobility.
Here’s where most guides give advice I’d push back on.
You’ll often see instructions to replace the server name with an IP address. That works, and it’s usually recommended because DNS resolution from the phone VLAN is broken and the IP address sidesteps the problem.
Fix the DNS instead.
Hard-coding an IP address means:
- Every URL has to be edited if the address changes
- Phones can only reach the one node you’ve specified, so a node outage takes Extension Mobility down even though the service is running elsewhere
- You lose the ability to point at a load-balanced name
If the FQDN doesn’t work from the phone subnet, that’s a DNS problem worth solving rather than routing around. Phones need to resolve the Unified CM nodes, and plenty of other things depend on that too.
If you genuinely can’t fix DNS, an IP address is a working compromise. Just know what you’ve traded away.
Step 3: Create the Extension Mobility phone service
Device → Device Settings → Phone Services → Add New
Service Name: something users will recognise, such as Extension Mobility. This is what appears on the phone’s Services menu, so it’s worth being plain rather than clever.
Service Description: optional, but useful for whoever inherits the cluster. Something like Allow mobile users to log into phones.
Service URL:
text
http://cucm-node.example.com:8080/emapp/EMAppServlet?device=#DEVICENAME##DEVICENAME# is a variable the phone substitutes with its own device name. Leave it exactly as written.
Secure-Service URL: leave blank unless you’re deploying Extension Mobility over HTTPS, which uses port 8443 and requires the appropriate certificate trust on the phones.
Service Category: XML Service
Service Type: Standard IP Phone Service
Enable: make sure this is ticked.
That last one is easy to overlook. An unticked service doesn’t appear on phones at all, and the symptom is that nothing happens when users press the Services button. There’s no error code, because the phone was never offered the service in the first place.
Don’t add the EMCC suffix unless you need it
If you append the Extension Mobility Cross Cluster suffix:
&EMCC=#EMCC#
login fails with an HTTP 400 error on phones that don’t support EMCC. Users see a blank screen when the service isn’t selected.
Only add it if you’re actually deploying Cross Cluster and every phone model in scope supports it.
If you change the service URL later
This catches people out.
Changing the URL on the phone service doesn’t automatically update the phones already subscribed to it. You need to click Update Subscriptions on the IP Phone Services Configuration page, and resubscribe any phone that was subscribed to the old URL.
The button sits in the toolbar at the top of the page, next to Save and Delete. It’s easy to walk past, because saving the change looks like it should be sufficient.
Skip it and the phones keep calling the old address, usually reporting Host not found. The configuration looks correct in Unified CM while every phone is still pointed somewhere else.
Step 4: Create device profiles
A device profile is a virtual phone. When a user logs in, the physical phone takes on the profile’s characteristics.
Device → Device Settings → Device Profile → Add New
Choose the profile type and device protocol to match the phone models users will log in to, then configure the profile as you would a phone.
Under Association Information, add the user’s directory number.
Save, then reset.
The profile needs to be compatible with the phones it’ll be loaded onto. A profile built for a model with more line keys than the target phone won’t present everything you configured.
Step 5: Associate the device profile to the user
User Management → End User
Find the user, then under Extension Mobility, move the device profile from Available Profiles to Controlled Profiles.
Tick Home Cluster.
That checkbox is easy to miss and it causes login failures that look like something else entirely.
Step 6: Subscribe phones and device profiles to the service
Both the physical phones and the device profiles need to be subscribed.
For a phone:
Device → Phone → select the phone → Related Links → Subscribe/Unsubscribe Services
For a device profile:
Device → Device Settings → Device Profile → select the profile → Related Links → Subscribe/Unsubscribe Services
Subscribing the phone lets a user log in. Subscribing the device profile means the service is still available once they have.
Miss the profile subscription and users log in successfully but then find the Services button no longer offers Extension Mobility, so they can’t log out.
Step 7: Enable Extension Mobility on the phone
Device → Phone → select the phone
Tick Enable Extension Mobility.
This is separate from subscribing to the service, and it’s the single most common configuration miss. A phone subscribed to the service but without this ticked will show the service, accept the login attempt, and return Error 22.
Multiple Login Behaviour
System → Service Parameters → select the server → Cisco Extension Mobility
Multiple Login Behavior has three settings:
| Setting | Behaviour |
|---|---|
| Multiple Logins Allowed | The user can be logged in at several phones simultaneously |
| Multiple Logins Not Allowed | Login at a second phone is rejected with Error 25 |
| Auto Logout | Logging in at a second phone automatically logs the user out of the first |
This is a design decision, not a default to accept without thinking.
Multiple logins suit users who want their extension on both a desk phone and a conference room phone. Auto Logout suits genuine hot-desking, where a user moving desks shouldn’t leave their extension behind.
Multiple Logins Not Allowed produces the most support calls, because a user who forgot to log out yesterday can’t log in today and the error tells them very little.
Extension Mobility error codes
This is what the article is really for. The phone shows a number and the user calls you.
Cisco publishes the full list in the Extension Mobility API response codes. These are the ones you’ll actually encounter.
Error 6 – Database Error
The Extension Mobility service can’t communicate with the database.
Check:
- The service is activated and running on the node in the service URL
- The service URL points at a node where Extension Mobility is actually running
- Cisco Tomcat is running on that node
This one usually means the service URL is pointing somewhere the service isn’t.
Error 12 – Device Profile not found
The user is trying to use a device profile that doesn’t exist, or isn’t associated with them.
Check:
- The device profile exists
- It’s in the user’s Controlled Profiles, not just Available Profiles
- Home Cluster is ticked on the end user
Error 18 – Another user logged in
Someone else is already logged in to that phone. They need to log out, or you can remove the login from Unified CM.
Error 19 – No user logged in
A logout was attempted on a phone with nobody logged in. Usually harmless.
Error 22 – Device logon disabled
Extension Mobility is not enabled on the phone.
Go to the phone configuration and tick Enable Extension Mobility. This is Step 7 above and it’s the most common cause of a login failure on an otherwise correct configuration.
Error 23 – User not found
The user ID is invalid. Check the user exists and that the user is typing the correct ID, not their email address or display name.
Error 25 – User logged in elsewhere
The user is already logged in at another phone and Multiple Logins Not Allowed is set.
Either find and log out the other phone, or reconsider whether that service parameter suits how people actually work.
Error 26 – Busy, please try again
The server is processing its maximum number of login and logout requests. Usually transient. If it’s persistent, look at whether something is generating a high volume of requests.
Error 27 – Change Password
The PIN must be changed on first use, or has expired. The user needs to change it through the Self Care Portal.
Error 28 – Untrusted IP Error
Login or logout was attempted from an IP address that isn’t trusted. Check the Extension Mobility service parameters for the trusted IP configuration.
Error 201 – Authentication error
Wrong user ID or PIN.
Before assuming the user has fat-fingered it, confirm the PIN is set in Unified CM and hasn’t expired. A blank or expired PIN produces the same error as a wrong one.
Host not found
Not a numbered error, but common.
- Cisco Tomcat isn’t running
- The service URL is wrong
- DNS isn’t resolving the hostname from the phone VLAN
- The service URL was changed without clicking Update Subscriptions
Problems that aren’t login errors
Phone services disappear after logout
The user logs out, the phone reverts to its default profile, and the Services button no longer works.
Check that Synchronization Between Auto Device Profile and Phone Configuration is set to True in Enterprise Parameters, and that the phone itself is subscribed to the Extension Mobility service.
Phone services unavailable after login
The user logs in successfully but has no services.
The device profile doesn’t have the Extension Mobility service associated with it. Subscribe the profile, not just the phone.
The phone resets instead of restarting
After login or logout, the phone does a full reset rather than a quick restart.
This is a locale change. If the user locale associated with the profile differs from the phone’s locale, the configuration file has to be rebuilt, which forces a reset.
No action required, but it’s worth knowing so you don’t chase it. If the delay bothers users, aligning the locales on profiles and phones removes it.
A configuration order that avoids most problems
Working through it in this order catches the common misses:
- Activate the service on every relevant node, and confirm Tomcat is running
- Sort out DNS from the phone VLAN before deciding on the service URL
- Create the phone service with the FQDN
- Build and test one device profile against one phone before doing the rest
- Confirm Home Cluster is ticked on the test user
- Subscribe both the phone and the profile
- Tick Enable Extension Mobility on the phone
- Decide on Multiple Login Behaviour deliberately
- Test a login, a logout, and a login at a second phone
Step 4 matters more than it looks. Getting one user working end to end takes ten minutes and tells you whether the service URL, the DNS and the subscriptions are right. Configuring fifty profiles first and then discovering the URL is wrong is a much longer afternoon.
The two things worth remembering
Subscribing a phone to the service and enabling Extension Mobility on the phone are two separate settings. Missing the second gives Error 22 on an otherwise perfect configuration.
The error code tells you exactly what’s wrong, if you know what the number means. Error 22 is the phone, Error 12 is the profile association, Error 201 is the credential, Error 6 is the service URL. That’s four different problems presenting as “Extension Mobility isn’t working”, and the number is the fastest way to tell them apart.
And if there’s no error code at all, because nothing happens when the user presses Services, check that the phone service itself is Enabled and that the phone is subscribed to it. No error means the phone was never offered the service.
References
- Extension Mobility API response codes – the complete numeric error list
From my early days on the helpdesk through roles as a service desk manager, systems administrator, and network engineer, I’ve spent more than 25 years in the IT world. As I transition into cyber security, my goal is to make tech a little less confusing by sharing what I’ve learned and helping others wherever I can.