SFTP Backup Failing / Not connecting - DPI-SSH

[Conor_Harvey_2000]

Hello,

We have a number of clients in our data center running 3cx linux PBX's.

For years we have used SFTP backups to a server on the same network where we keep the backups. We have recently noticed that the backups haven't even been starting.

Upon investigating, when turning DPI-SSH off, this starts working fine again. We have always had DPI-SSH turned on and want to keep this on.

Has anyone had this issue as well or could let me know if a recent 3cx update could have affected this?

Its very annoying as we were not getting alerted that these wern't backing up as they were not failing the backup, but just not starting at all.

Many thanks,
Conor

 

[AbdullaR_3CX]

Hi @Conor_Harvey_2000

Since the backups start successfully when DPI-SSH is disabled, the behavior appears to be related to the firewall's SSH inspection.

Could you please verify whether your firewall is inspecting the SSH traffic used for the SFTP connection? If so, create an exception or bypass rule for the SFTP connection between the PBX and the backup server, then test the backups again.

 

[Conor_Harvey_2000]

Hi @Conor_Harvey_2000

Since the backups start successfully when DPI-SSH is disabled, the behavior appears to be related to the firewall's SSH inspection.

Could you please verify whether your firewall is inspecting the SSH traffic used for the SFTP connection? If so, create an exception or bypass rule for the SFTP connection between the PBX and the backup server, then test the backups again.

Hello,

Yes indeed it is and always has been.

We could add exculsions for all the PBX's but we are trying to work out what suddenly stopped this from working. The earlied instance of it not working seems to be the first of this month.

Many thanks,
Conor

 

[Charles_3CX]

We recommend excluding 3CX traffic from any Deep Packet Inspection (DPI), SSL/TLS inspection, SIP ALG, or application-layer inspection on your firewall, as these features can interfere with SIP signalling, TLS connections, WebRTC traffic, and RTP media streams, potentially resulting in registration, call setup, or audio issues.