3CX behind Sophos UTM-9 Firewall

[MarkLFT]

Has anyone successfully configured a Sophos UTM Firewall to enable a 3CX system? I have been working with Sophos for a while, so am comfortable forwarding ports and publishing simple sites, but I am having problems with 3CX.

My 3CX is using the built-in web server, configured for ports 5000 / 5001. I have published these the same way as I already have several other websites published. I have forwarded port 5060/61, 5090, and 9000 -9049 to the correct host, but still I have issues.

The issues I have is:

1. Browsing to the admin website, works inside the firewall, but from outside, it starts to load the pages, shows headers, and the rotating circle, but never displays any content. From inside the firewall it works correctly.

2. If I run the firewall test, it fails on the first test, but I can resolve the stun server addresses, I have port 5060 forwarding to the IP address of the 3CX system, but still nothing works.

I would be greatful for any and all advice.

Thanks

 

[MarkLFT]

Ok rookie error. Problem with ports fixed, set Sophos firewall correctly, forget the Windows Firewall.

 

[marzetti]

Hi Little,
May I ask what rules you setup on the UTM to get this to work? We also have a UTM here and are having issues.

 

[mr_jack]

Hi Little,

I'm too interested in which firewall / nat rules you created on the UTM so that the 3cx firewall was happy.

For NAT was it DNAT or 1 - 1 NAT ?

Maybe an example ?

Thanks.

Jack

 

[AndyBarr]

I have fallen foul of this a couple of times, so I bet that the NAT rules were all created but forgot to open the firewall ports.

 

[Superheater]

Like mr_jack, I am interested in what rules you used to get this working too. I am familiar with NAT rules but I am struggling to get this working from behind Sophos UTM.

 

[TCF]

I am interested in the settings as well. Has anyone got it working since posting?

 

[TCF]

I'm working on setting it up right now. When I get it working I'll post a tutorial.

 

[ThomasD_3CX]

Hello,

Keeping in mind that the network and 3rd party configuration is out of 3CX scope I would like to inform you that:

1. Browsing to the admin website, works inside the firewall, but from outside, it starts to load the pages, shows headers, and the rotating circle, but never displays any content. From inside the firewall it works correctly.
- I assume you are applying on the firewall AV or IPS services. A packet capture on the firewall would have been helpful since you will see what kind of traffic is dropped to the PBX destination and adjust the configuration accordingly.

2. If I run the firewall test, it fails on the first test, but I can resolve the stun server addresses, I have port 5060 forwarding to the IP address of the 3CX system, but still nothing works.
- When firewall checker fails means that something was miss-configured. Verify the configuration one more time and pcaps would be the solution in order to determine the root cause of the issue. 5060 is not the only port needed from the PBX (see bellow provided link)

Please let me provide you some documentation that may be helpful:

• Ports used by 3CX Phone System
- http://www.3cx.com/blog/docs/ports-used/

• Firewall & Router Configuration
- http://www.3cx.com/docs/firewall-router-configuration-voip/

• Firewall Configuration for 3CX Phone System (Sophos NOT included but it might be of use)
- http://www.3cx.com/support/firewall-configuration/

Thanks.

 

[MillsAz]

I have had tons of fun setting up Sophos UTM 9 for 3CX. Here are the steps to take:

1. DO NOT SETUP Network Protection > VoIP. It will result in complete failure. I've spent hours on support with Sophos and the answer is do not turn it on.
2. Create your Service 3CX_Service (Definitions & Users>Service Def) and add the ports here: http://www.3cx.com/blog/docs/ports-used/

3. Create the Network Def for your internal 3CX server.

4. Create your external interface (Interfaces & Routing>Interfaces>Additional Addresses), Name it 3CX_WAN:

• External interface: USE /32 Netmask rather than ISP's subnet mask

5. Create Masquerading Rule (Network Protection>NAT>Masquerading tab), use the interface created in step 4 in the Use Address and Network from Step 3. Interface is your ISP uplink which should already exist if you can access the internet.


6. Create your DNAT rule (Net Protection>NAT>NAT tab), "Going To" is the Interface ADDRESS and not the network.


7. If you have Intrusion Prevention turned on (Net Protection>Intrusion Prov) then go to the Exceptions tab and add exception

• I created 2: Internal & External
• External

• Internal

8. Make sure all the NAT, Masquerade, and Exceptions are all turned on so you see
9. Now your are ready to test the Firewall Diagnostics in the 3CX console.
10. You will see some of the Media Server ports failed, but some didn't. This is because the Anti-PostScan is turned on in the UTM Net Prot>Intrusion Prev>Anti-PortScan tab. Turn it off and try the firewall diags again and everything will pass.

If you are still having troubles with the 5060 or 5090 ports you should recheck all the settings in the UTM.

Good Luck!!

 

[YiannisH_3CX]

thank you for sharing @MillsAz, i am sure many people will find this helpful