3CX Hosted with SBC on a high-security, heavily firewalled network?

[KMorley]

I have an opportunity to install a 3CX V20 hosted system to support 12 branch offices. The networks in these sites are not interconnected. Each connects to a central data center, but there is no connectivity between the sites. Additionally, the sites can optionally have Internet access for specific devices.

At this point, I am planning to deploy a single V20 hosted system, an SBC at each location and obtain internet access each of the SBCs. The phones would be models from the 3CX recommended list, so all firmware upgrades would be through the 3CX platform and not direct from the manufacturer. Here are the questions:

1) The security vendor who controls this network will likely require that the devices with internet access be whitelisted for specific IP addresses, rather than be able to access ANY IP address. Can we predict in advance which IP addresses the SBC will connect to? Are the only connections to the 3CX host system (at Digital Ocean) and the SIP Gateway (SIP Trunk)? Or will the SBCs need connectivity to additional IPs?

2) In the environment described, does ALL traffic transit through the SBC's? All SIP and RTSP traffic? Firmware updates for the phones? Or will the phones also need at least some internet access (for firmware updates, administration, etc.)?

Thanks in advance!

Ken Morley

 

[biggreyphone]

I have a setup like this with a hosted V20 system and SBCs at individual locations, and I needed no firewall adjustments to get everything to work nicely.

 

[SteveITS]

SBCs connect to the 3CX server. Phones proxy audio through the SBC and I’m pretty sure everything else, e.g. BLFs go through it. Before provisioning they might connect directly to your 3CX server. If you’re setting up the SBCs first, the phones shouldn’t need to be added in advance so won’t contact the manufacturer RPS, IIRC. Plug in phone, assign to extension.

 

[KMorley]

Thanks to both of you for the great info. To summarize:

If the SBCs can communicate with the 3CX hosted system, the phones will proxy through the SBC for everything and therefore do not need any internet access whatsoever.

Thanks again!

 

[CentrexJ]

The phones need to connect to an ntp server for time. So you may need to use custom templates or open ntp access over internet for the phones. The phones need to connect to pbx to obtain provisioning file and phonebook. Perhaps put pbx in the data centre.

 

[bdoviack]

The phones need to connect to an ntp server for time. So you may need to use custom templates or open ntp access over internet for the phones. The phones need to connect to pbx to obtain provisioning file and phonebook. Perhaps put pbx in the data centre.

Believe the SBC should handle all of this. We have all our phones behind the firewall and the SBC did all the provisioning and phonebook synchronizations. PS, we are using a Ribbon/EdgeMarc "Industrial" SBC which was expressly designed not to have to open any firewall ports.

 

[CentrexJ]

Believe the SBC should handle all of this. We have all our phones behind the firewall and the SBC did all the provisioning and phonebook synchronizations. PS, we are using a Ribbon/EdgeMarc "Industrial" SBC which was expressly designed not to have to open any firewall ports.

Sounds like you have a custom template then because the default for 3cx is that the phone gets time from public ntp and provision file from fqdn.