Support Procedure for Troubleshooting Remote Extensions

3CXPhone for Windows can prove very useful in troubleshooting remote extensions. 3CXPhone for Windows version 11 SP1 includes a Verbose Logging feature which embeds session information in the SIP packets. This information is then analyzed by 3CX Phone System to provide a NAT / ALG report for the call in its Server Activity Log. This logging can prove very useful when troubleshooting VoIP calls passing through a WAN to LAN device such as a router or firewall, which may be altering the VoIP traffic.

Before running through this procedure, it is recommended that you confirm that your firewall / router is configured correctly to route VoIP traffic to the PBX. This can be confirmed using the 3CX Firewall Checker.

Once you have confirmed that VoIP traffic is being routed correctly, and that the problem persists, you can proceed as follows to enable logging in 3CX Phone for Windows and analyze the results in the 3CX Server Activity Log on the server.

  1. At the remote network location, download and install 3CXPhone for Windows on a machine which is part of the same network as the phones. Note: 3CXPhone for Windows must be version 6.0.26523 or higher
  2. Configure 3CXPhone for Windows to register to the 3CX Phone System without 3CX Tunnel enabled. 3CXPhone for Windows should register as an external extension using STUN.
    1. To do this, click on the Menu button (the button at the bottom of 3CXPhone), and select Accounts
    2. Fill in the Account Details and the Credentials.
    3. In My Location, select ‘I am out of the office – external IP’ and insert the external IP address of the PBX.
    4. Do NOT enable ‘Use 3CX Tunnel’, ‘Use Outbound Proxy server’ or Perform provisioning from following URL’
    5. Click Advanced Settings.
    6. Change ‘STUN server’ to: <External IP of PBX>:<SIP port of PBX>
      e.g. 45.23.56.125:5060.
    7. Click OK twice to save the changes.
    8. Make sure that the remote extension registers. If 3CXPhone for Windows does not show ‘On Hook’, you need to check your settings and try again.
  3. Once the remote extension registers, open the 3CXPhone Menu, and select Preferences.
  4. From the Preferences, enable Verbose Logging.
  5. Ensure that allow video calls is disabled. This keeps avoids increasing the size of the SIP packets unnecessary.
    3CXPhone Preferences
  6. Click OK to save the changes. 3CXPhone will re-register with 3CX Phone System and will enable VoIP debugging.
  7. The next step is to enable the interpretation of the verbose logging in 3CX Phone System. Log into the 3CX Management Console, navigate to Settings > Advanced > and in the ‘Logging level’ section select Verbose. If you are already in verbose mode, press Apply to ensure that the interpretation of verbose logs is enabled.
  8. You are now ready to make a test call using 3CXPhone for Windows. Dial the Echo Test Extension – *777 which tests both incoming and outgoing connections to the extension at the same time. To confirm that the call is successful, wait for about 40 seconds before hanging up.
  9. Once you have completed the call, access the 3CX Management Console, and click on Server Activity Log. In the Filter by Extension dropdown select the extension that just made the call and select the last call in the filter by call dropdown list.3CX Server Activity Log
  10. You will see messages that start with the following: ‘NAT/ALG check:’. Below is an example of a successful check:

    NAT/ALG check: L:16.1[Extn:101] REQUEST ‘INVITE’ – No changes detected in SIP headers.

NAT / ALG Messages in More Detail

The following is the logging that will be shown when 3CX Phone System detects changes in the SIP packets:

SIP Proxy Detected

NAT/ALG check: L:16.1[Extn:101] REQUEST ‘INVITE’ – some of SIP/SDP headers may contain inconsistent information or modified by intermediate hop.
SIP proxy detected: <2.2.2.3>

This message is shown when the PBX and the end point are communicating through a proxy. This is generally an informational message. If there are issues, the proxy servers should be taken into consideration. In this example, the IP 2.2.2.3 is the proxy server that has been detected.

IP Address / Port in SIP Header and source IP do not match

NAT/ALG check: L:16.1[Extn:101] REQUEST ‘INVITE’ – some of SIP/SDP headers may contain inconsistent information or modified by intermediate hop. SIP contact header is not equal to the SIP packet source (IP:port):
Contact address: 192.168.2.5:5060
Received from: 5.5.5.6:4567

This message is shown when the IP or port in the Contact SIP header does not match the source IP or port from where the sip packet was sent. In this case, 192.168.2.5:5060 is the IP address and port found in the SIP Contact header. However the packet arrived from 5.5.5.6:4567. This happens in one of the following scenarios:

  • The SIP contact information has been altered in transit.
  • NAT is not configured correctly.
  • The remote extension is incorrectly using the local IP address in the SIP Contact Header.
  • The external extension is not using the correct external IP address obtained from STUN.

IP Address in Media Session and SIP header do not match

NAT/ALG check: L:16.1[Extn:101] REQUEST ‘INVITE’ – some of SIP/SDP headers may contain inconsistent information or modified by intermediate hop. Media session IP (‘c=’ attribute) is not equal to the IP specified in contact header:
Media session IP: 192.168.1.3
Contact IP: 4.4.4.5

This message is shown if the media session IP address specified in the SDP is not equal  to the IP address specified in SIP Contact header.

IP Address in Media Session and source IP do not match

NAT/ALG check: L:16.1[Extn:101] REQUEST ‘INVITE’ – some of SIP/SDP headers may contain inconsistent information or modified by intermediate hop. Media session IP (‘c=’ attribute) is not equal to the SIP packet source(IP:port):
Media session IP: <media session IP specified in SDP> 10.172.0.1
Received from: <source of the SIP message> 192.168.1.3

This message is shown if the media session IP address specified in the SDP is not equal to the source  IP from where the SIP packet came from.

Modified SIP Via detected

NAT/ALG check: L:16.1[Extn:101] REQUEST ‘INVITE’ – some of SIP/SDP headers may contain inconsistent information or modified by intermediate hop.
VIA header was modified:Original: <original via header> Via: SIP/2.0/UDP 192.168.1.133:55070;branch=z9hG4bK-d8754z-8a0e8e47fd3e6b57-1—d8754z-;rport
Received: <received via header> Via: SIP/2.0/UDP 10.172.0.5:55070;branch=z9hG4bK-d8754z-8a0e8e470000000-1—d8754z-;rport

This is an information message indicating that the SIP VIA header has been modified. This is generally an informational message. If there are no issues, this can be ignored. However if there are issues, it would be worth to check this out.

Modified SIP Contact IP Address detected

NAT/ALG check: L:16.1[Extn:101] REQUEST ‘INVITE’ – some of SIP/SDP headers may contain inconsistent information or modified by intermediate hop. Contact header was modified:
Original: 78.158.230.2
Received: 10.172.0.5

In this case, 3CX Phone System compares the original contact IP Address and port generated by the phone with the contact header specified in the SIP packet.

Modified SDP Session IP Address detected

NAT/ALG check: L:16.1[Extn:101] REQUEST ‘INVITE’ – some of SIP/SDP headers may contain inconsistent information or modified by intermediate hop. Modification of SDP session level ‘c=’ attribute detected:
Original: 78.158.230.2
Received: 10.172.0.5

In this case, 3CX Phone System compares the media session IP specified by the 3CXPhone for Windows with the media session IP received with the SIP packet.

Modified Audio Media IP Address detected

NAT/ALG check: L:16.1[Extn:101] REQUEST ‘INVITE’ – some of SIP/SDP headers may contain inconsistent information or modified by intermediate hop. Modification of audio media ‘c=’ attribute detected:
Original: 78.158.230.2
Received: 10.172.0.5

This check is only for audio media. 3CX Phone System checks whether the connection information for audio has been modified.

Modified Audio Media Port detected

NAT/ALG check: L:16.1[Extn:101] REQUEST ‘INVITE’ – some of SIP/SDP headers may contain inconsistent information or modified by intermediate hop. Modification of audio media port detected:
Original: 78.158.230.2
Received: 10.172.0.5T

This check is only for audio media. 3CX Phone System checks whether the port number for audio has been modified.

SIP Packets are generally incorrectly altered by firewalls and routers. Some firewalls / routers do this on purpose in an attempt to address issues introduced by NAT – this is often referred to SIP ALG. However, different firewalls / routers implement this differently, and the safest way is to disable SIP ALG (or any SIP Helpers) and configure Static NAT in the firewall / router as explained here.

Related articles

Liked this article?


Get notified of new articles
or share
You might also be interested in:
  1. Very useful feature of V11. This has just helped prove the source of my remote extension problem which was caused SIP/ALG on a Belkin router.

    October 5, 2012 at 1:33 am
    • @Ian – Thank you for your feedback. We are very interested in ways we can improve troubleshooting guides for users, partners and resellers of 3CX.

      October 5, 2012 at 3:50 am