3CX remote Office SNOM M300

[klm]

Hello,

I use a 3CX with TLS and secure RDS the remote softphones are functional but the SNOM M300 are functional only one way call to external when i want to receive a call, the Softphone rings but not the Ip phone.
I change the Transport SIP TLS to UDP and the Ip phones receive the call...
In fact for security reason i want to use the TLS transport for the extensions authentication.

Thx for your help.

Regards

 

[GiannosC_3CX]

Hi klm,

What version are you on? (wind-linux and service pack)
Also please let us know if the extensions are local or remote. Please give us more details about your setup.

 

[klm]

Hi GionnosC_3CX,

3CX version : 15.0.60903.0 - Linux Debian
Extensions are remote : External 3CX and local IP phone Snom300 (provisioning with 3CX or manual).
3CX : TLS secure SIP enable with certificate / Secure RTP / Only accept secure connexion (extensions)
Snom M300 : Certificate installed
Issue : SIP GW ---> 3CX ---> (secure comm) SNOM M300 (the remote Ip phone does not ring but the softphone rings) i can make external call with Ip phone but i can't receive communication.
How can i change the verbose mode in 3CX ?

 

[GiannosC_3CX]

Hi klm,

Did you open the 5061 port on your remote location?

I change the Transport SIP TLS to UDP and the Ip phones receive the call

 

[klm]

Hi GiannosC_3CX,

Yep i make a DMZ to be sure but same result.

Thx for your help.

 

[klm]

I test the open port with NMAP when i change the rules with Iptables (OPEN status for INPUT) the result :

PORT STATE SERVICE
22/tcp filtered ssh
25/tcp open smtp
80/tcp filtered http
135/tcp filtered msrpc
139/tcp filtered netbios-ssn
443/tcp open https
445/tcp filtered microsoft-ds
5060/tcp open sip

As you see the port 5061 is not open why my 3CX doesn not listen on this port ? (Secure TLS SIP is enabled)

 

[GiannosC_3CX]

Hi klm,

Did you install the 3CX-ISO or manually?

 

[klm]

Manually because i installed in a VPS the OS is debian.

 

[klm]

It's really stange because the SOftphone use the 5061 port...

 

[GiannosC_3CX]

On the ISO the port 5061 is opened by default.
Remote 3CXSoftphones use tunnel port which is 5090 and is encrypted by default. No needed CA installation on the machine. The only way on the 3CXSoftphones to use the sip-tls is in the same subnet with 3CXPhone system.
Also SNOM M300 has limitations (cannot be provisioned remotely)as seen: https://www.3cx.com/sip-phones/snom-m300-m700-dect/ and you need to configure it manually.
You need to install the CA on the phone and then modify the “Registrar” port from 5060 to 5061 and the “Outbound Proxy” port from 5060 to 5061 and also append ;transport=tls to the end, e.g. from pbx.public:5060 to pbx.public:5061;transport=tls (Setup => Identity 1).

 

[klm]

Hi GiannosC_3CX,

The root ca has already insalled on Snom M300.
Iptables rules is already added :
ACCEPT tcp -- anywhere anywhere tcp dpt:sip-tls
Snom M300 the port is 5061 "Registrar" "Outbound Proxy"

Please advise and thx for your help.

 

[GiannosC_3CX]

Hi klm,

The root ca has already insalled on Snom M300.
Iptables rules is already added :
ACCEPT tcp -- anywhere anywhere tcp dpt:sip-tls
Snom M300 the port is 5061 "Registrar" "Outbound Proxy"

Your settings look correct, but as I have mentioned these phones have limitations and are not tested by us, the only thing that I can suggest is try a phone that has been tested. This will give you a clue as to where the fault is.

 

[klm]

I understand but why i can make call to outside with TLS secure auth and i can't receive call (only with the softphone).

It's really strange if the SNOM can't use TLS it's for the two way : send and receive call

 

[Sopock]

Or it will use it with new firmware?

 

[klm]

Yep new firmware used for snom M65 & M300