Slider 2TryLearn MoreSlash your Phone bills - Slider Image

Use SIP trunks, WebRTC & Apps

Slash your Phone Bill by 80%

Course Content - Intermediate

Remote IP Phone Extensions (SBC)


Welcome to the online training series from 3CX. This module will take you through the configuration of Remote Extensions using the 3CX Session Border Controller, or SBC.


Todays training will focus on the correct implementation of IP Phones in a remote location using a 3CX Session Border Controller.


This module assumes that you already know how to provision a local IP Phone, and have the firewall at the PBX site already configured.

You will need to use a 3CX Supported IP Phone, running the recommended firmware version. This is to ensure that the firmware supports the SSL certificates in use by 3CX for the provisioning of the phones.

A machine running any of the supported Operating Systems will need to be installed at the remote location.

Other requirements for the machine running the SBC, is to have only 1 LAN Adapter, using only one static IP Address. Do not use a wifi adapter.

Disable any unused adapters on this machine, like built in WiFi adapters, Bluetooth, WAN Miniport devices as well as any VPN adapters or virtual NICs.

The remote location is not required to have a static public IP Address. A dynamic IP Address is allowed, as the SBC will always initiate the connection to the PBX.


When using a Windows or Debian based SBC, there is a limitation of 50 extensions connecting via the SBC, or a total of 100 Simultaneous calls or 250 BLF keys across all phones.

The hardware specification guidelines are available on our website at the link shown in the slide, and from the Administrator Guide.

When you are running the SBC on a Raspberry Pi 2 or 3, you can have a maximum of 20 extensions or simultaneous calls, or a total of 200 BLFs across all devices.


The phones which can be used to connect via the SBC and have full support are the phones which are manufactured by the 3CX supported manufacturers.

The full list is provided at

In the diagram we can see the 3CX clients are connecting to the PBX using the tunnel protocol directly to the PBX.

As the 3CX Tunnel Protocol is proprietary to 3CX, the IP Phones will not be able to connect natively through the tunnel protocol, therefore an extra device is required to achieve this type of connection. This is what the 3CX Session Border Controller provides. A tunnel connection to the PBX.


The 3CX SBC provides various benefits to a remote location.

It will provide internal call capabilities, allowing users to use their phone just like they are in the office.

The administrator can arrange for phones to be drop shipped to a remote location, without the need to have them shipped to the office, configure them, and then send them off to the remote location.

With the SBC in place, you can use plug and play provisioning, just like provisioning a local IP Phone.

The audio traffic will remain local and in the same LAN, without the need for the PBX to relay the audio between two extensions, which are provisioned through the same SBC. As the audio remains within the network, bandwidth usage is reduced at the remote site.                

As the SBC will be initiating the connection to the PBX, there will be no need to perform a port forwarding at the remote site. Also, as the SBC is connecting to the PBX over the tunnel port, there is no SIP ALG inspection being performed by the firewalls. SIP ALG will only inspect the traffic on the SIP Port, if it is 5060.

The SBC will provide encryption of the calls over the internet, between the remote site and the PBX.

And lastly, the software is provided for free, without any additional cost, other than the calls being made, which use up the license from the PBX, just like a local extension.


Before connecting the SBC to the PBX, some snippets of information are required from the PBX, in order to configure the SBC.

These are the SIP and Tunnel ports of the PBX. These can be found under: Settings, Network and then under the Ports tab.

The 3CX Tunnel password, can also be found in the PBX settings, but under “Security” and then under the “3CX Tunnel” tab.

The public FQDN of the PBX will also be required, to instruct the SBC where to connect. This is found in the dashboard of the PBX, in the Information section.


The installation of the SBC is very straight forward. You can download the latest version from the 3CX website, You can also download the SBC from the customer portal, from where you release your FQDN.

Fill in the required information, acquired in the previous slide.

Optionally, enable encryption to the PBX and set a failover PBX, if you are utilising this type of deployment.


All that is required now, is to boot the phone in the remote location if it is a new phone, or reset the phone if it is a phone which was already in use previously.

You will see the plug and play request coming in through multicast, just like a local phone, in the “Phones” page. Assign it to an existing extension, or create a new extension, just like you would with a local IP Phone.

Wait a few seconds, and the phone is now provisioned.

The provisioning of the phone is done via HTTPS through the internet, and not through the SBC. Only the SIP and Audio traffic are tunneled through the SBC.

[SLIDE 10]

Thank you, and goodbye!

Free for up to 1 year! Select preferred deployment:


for Linux on a $200 appliance or as a VM

Get the ISO


for Windows as a VM

Download the setup file

On the cloud

In your Google, Amazon, Azure account

Take the PBX Express