3CX behind Palo Alto Firewall Config

[cpe90]

Hi all,
I'm new here.

Anyone here mind sharing your pan fw configuration so the firewall test on the 3CX dashboard will pass?
I have followed the article on
https://www.3cx.com/docs/manual/firewall-router-configuration/
But for some reason, it kept failing. Under my monitor tab, I see outbound on port udp 3478 is being denied during the firewall test but I do not see that port being mentioned in 3CX article as one of the port that needs to be opened.
I also see port udp 5060 outbound there but it's not mentioned in the article as one of the ports that need to be allowed.
Do I need to open those ports?

The weird thing is, I think our 3CX is working just fine. I can do outbound and inbound calls from the app.
We are planning to go live soon.

Much appreciated for the help.
Thank you.

Here are my FW test results if you are curious.

• resolving 'stun-us.3cx.com'... done
• resolving 'stun2.3cx.com'... done
• resolving 'stun3.3cx.com'... done
• resolving 'sip-alg-detector.3cx.com'... done
• testing 3CX PhoneSystem 01 SIP Server... failed (How to resolve?)
  • stopping service... done
  • detecting SIP ALG... failed (How to resolve?)
  • testing port 5060... not reachable (How to resolve?)
  • starting service... done
• testing 3CX PhoneSystem Media Server... failed (How to resolve?)
  • stopping service... done
  • testing port 5090... not reachable (How to resolve?)
  • testing ports [9000..9398]... failed (How to resolve?)
    • testing port 9000... not reachable (How to resolve?)
    • testing port 9002... not reachable (How to resolve?)
    • testing port 9004... not reachable (How to resolve?)
    • ...
    • testing port 10988... not reachable (How to resolve?)
    • testing port 10990... not reachable (How to resolve?)
    • testing port 10992... not reachable (How to resolve?)
    • testing port 10994... not reachable (How to resolve?)
    • testing port 10996... not reachable (How to resolve?)
    • testing port 10998... not reachable (How to resolve?)
  • starting service... done

 

[SteveITS]

https://www.3cx.com/docs/ports/
5060 is inbound…typically the checker is looking for inbound ports and I think assumes outbound from the server is allowed.
Technically speaking ports not used don’t need to be opened, but it may be confusing down the road if something isn’t working as expected.

 

[N_G]

If the firewall checker fails you will have problems. Your firewall is blocking traffic.

The apps tunnel traffic over 5090 so internal calls will work but you will have major problems with calls via SIP trunk providers.

 

[cpe90]

If the firewall checker fails you will have problems. Your firewall is blocking traffic.

The apps tunnel traffic over 5090 so internal calls will work but you will have major problems with calls via SIP trunk providers.

Thank you for your feedback.
We are using PRI for the on-prem and not SIP trunk provider just yet.
I wonder if this firewall test is for on-prem that is using SIP providers so it can safely being ignored.
Is that a correct assumption?

 

[SteveITS]

The firewall test tests everything. (Though IIRC a sample of media ports)

 

[cpe90]

https://www.3cx.com/docs/ports/
5060 is inbound…typically the checker is looking for inbound ports and I think assumes outbound from the server is allowed.
Technically speaking ports not used don’t need to be opened, but it may be confusing down the road if something isn’t working as expected.

Thank you for your feedback.
The firewall configuration page is mostly showing for inbound traffic only. A few has outbound being specified.
Should I allow those ports for both in and outbound?

 

[cpe90]

I'm not sure if this is the right thing to do, but I did this on my PAN firewall to get the firewall check to pass.

When I ran the Firewall Check, PAN did not see any activities on any of the ports listed above hence the Firewall Check failed with the result posted in my original posting.

The only activity I see was outbound traffic for UDP Port 3478 (Stun) and 5060 (Sip) being blocked because they are listed as known ports for outbound traffic on the manual.
https://www.3cx.com/docs/manual/firewall-router-configuration/

Once I added those two ports to my 3CX outbound rule, the firewall check passed without an issue.

Here are the results:

resolving 'stun-us.3cx.com'... done
resolving 'stun2.3cx.com'... done
resolving 'stun3.3cx.com'... done
resolving 'sip-alg-detector.3cx.com'... done
testing 3CX PhoneSystem 01 SIP Server... done
stopping service... done
detecting SIP ALG... not detected
testing port 5060... done
starting service... done
testing 3CX PhoneSystem Media Server... done
stopping service... done
testing port 5090... done
testing ports [9000..9398]... done
testing port 9000... done
testing port 9002... done
...
testing port 9396... done
testing port 9398... done
testing ports [10600..10998]... done
testing port 10600... done
testing port 10602... done
testing port 10604... done
...
testing port 10996... done
testing port 10998... done
starting service... done

Anyone else has this experience?
Should I keep this configuration on fw?

Thank you, guys.