3CX V20 Hosted - Firewall openings required for VOIP phones?

[KMorley]

This is a V20 hosted system (hosted by 3CX) with 13 locations (stores). Each site has a separate SBC providing communications back to the 3CX PBX hosted at Digital Ocean. This customer is very security-conscious and we are required to configure firewalls to limit access to that traffic needed for the system to work. I understand the SBCs provide all the communications the phones need to communicate with the 3CX PBX.

But what about provisioning and firmware updates? What kind of Internet access do the phones need to contact the manufacturer's provisioning server on initial startup and to retrieve firmware updates going forward? Is it just DNS and HTTP/HTTPS? Or are there other protocols we will have to allow through the firewalls for the phones themselves?

Thanks!

 

[TheodorosG_3CX]

You can check the guideline here however for the provisioning https port is required.

 

[KMorley]

You can check the guideline here however for the provisioning https port is required.

Thanks for the reply. I had already read that guide thoroughly and multiple times. The guide barely touches on the phones. I know from the Basic Certification course that the phones have to contact the manufacturer's (Snom in this case) registration server to obtain the provisioning URL. The guide mentions the 3CX RPS server, but omits anything about needing to contact the manufacturer's provisioning server. It would be nice to have a concise list of which devices need what access.

 

[NicholasP_3CX]

The manufacturers RPS servers only provide the PBX Provisioning URL. Once provisioned onto 3CX, the firmware updates are done directly from the PBX. We no longer have anything to do with the RPS server.

 

[KMorley]

The manufacturers RPS servers only provide the PBX Provisioning URL. Once provisioned onto 3CX, the firmware updates are done directly from the PBX. We no longer have anything to do with the RPS server.

Yes, that is my understanding from the Basic Certification class. The manufacturer's RPS is only involved if the phone is completely unprovisioned. The only times that will happen is when deploying a brand-new phone OR factory defaulting an existing phone. But we still have to anticipate and plan for those two situations. In my opinion the guide should at least mention that.

With the installation I am currently working on, the WAN vendor requires that I define which protocols the equipment use and which hosts on the public Internet the equipment will access. I think the answer in this case is: the phones require DNS resolver access and then HTTP and HTTPS access to the outside world.