Solved 2nd raspbian SBC not connecting

[ITRUSA]

1. Created a rPi SBC with v15--worked perfectly and still does.
2. Upgraded to v16 (16.0.910)
3. Created a new rPi, with Stretch Lite; during SBC installation process, fails at provisioning step.
   1. Tried IP instead of domain
   2. Ensured local firewall setup properly
   3. Moved to different ISP/location
   4. Deleted / Created new SBC in 3CX Console
   5. Verified that firewall passes firewall checker
4. Flashed rPi with Buster-Lite
   1. Same result as above.
5. All the while, the original SBC is working just fine

What else can I try?

 

[AWS2P]

did you use 3cx raspbian iso for sbc install ?

 

[ITRUSA]

No! Where do I find that? I didn't see any mention of it here: https://www.3cx.com/docs/3cx-tunnel-session-border-controller/#h.z1elqkjum64a

 

[AWS2P]

my bad, made confusion with debian iso pbx install

 

[Alphabetic]

Is your 3CX PBX up to date with the latest updates?

 

[cobaltit]

Make sure you follow the guide below, downloading the Stretch-based Raspbian and not the Buster version and that you created (and saved) the SBC trunk prior:

https://www.3cx.com/docs/3cx-tunnel-session-border-controller/#h.z1elqkjum64a

https://downloads-global.3cx.com/downloads/misc/2018-06-27-raspbian-stretch-lite.zip

https://downloads.raspberrypi.org/r...an-2018-06-29/2018-06-27-raspbian-stretch.zip

Also, make sure you aren't blacklisted (if from a different IP) or port forwarding 5090 to the SBC (if on the same IP/behind the same firewall). SBC requires no port forwarding to the SBC.

 

[ITRUSA]

Thank you for your help.

• 3CX PBX is up to date (16.0.910)
• I just found that image and tried it again--same result.
• IP is not black listed.
• the SBC is on a different subnet than the PBX.
• there is no port forwarding setup on the SBC's firewall.

 

[cobaltit]

Are you getting an error after putting in the PBX Web URL or the SBC Authentication key? What is the error message?

 

[ITRUSA]

After entering both, it attempts to connect. It then gives me:

Cannot obtain provisional data​

​

Unable to reach the 3CX Server at https://3xc.mydomain.com ​

Please double check "3CX PBX Web URL" value and confirm that the SBC Trunk is created properly within your 3CX Management Console. ​

​

Also 3CX must have a valid secure SSL Certificate so if you have a custom certificate which has expired or not renewed, the installation will fail. ​

​

<Retry> <Abort>​

I do have a valid certificate. The URL is correct and usable. I have deleted and recreated a SBC trunk, too.

 

[cobaltit]

Hmm. I would confirm DNS resolution by pinging the FQDN from the Pi itself, and then I would confirm you can reach the 3CX Management console from that network to make sure you aren't blacklisted (and are using the correct port). And lastly since you said 3xc.mydomain.com are you using a 3CX FQDN or your own? If your own you may have a valid SSL certificate but not necessarily one that the SBC has a trusted root for.

 

[ITRUSA]

ping does resolve the correct IP using the FQDN.
i can reach the 3CX Management console from a PC on the same LAN (so not black listed)
the trusted root certificate is an interesting idea; i will try to see if I can determine that.

 

[ivank]

Did you specify the port with your FQDN?

 

[ITRUSA]

we are using 443; I have tried with and without; same error.

 

[ITRUSA]

I installed lynx on the Pi and attempted to connect to the URL--it gives an error with the Cert: "SSL error: The certificate is NOT trusted. The certificate issuer is unknown." A workstation on the same network can connect to the same URL and the certificate is valid.

Could something have happened to the cert during the upgrade from v15 to v16?

 

[ITRUSA]

I tested the site using two different SSL checkers. Both reported that it is OK except that it doesn't include the intermediate certificates.

on the Pi, I ran:

sudo apt-get update​

sudo apt-get -y --reinstall ca-certificates ​

​

​

Problem remained.

I could successfully open another site that uses the same certificate (wildcard).

This solved the problem: https://www.3cx.com/community/threads/3cx-removes-intermediate-certificate-from-ssl.45167/

 

[ITRUSA]

Thank you all for your help!

 

[cobaltit]

Good troubleshooting and thanks for posting the detailed steps towards resolution.