3CXPhone v14 Remote - Calls Forbidden

[AlanM]

Since upgrading to v14SP2, my 3CXPhone for Windows will not work outside the LAN. I have configured the extension in the management console ensuring "use the tunnel connection" box was checked and unchecking "disallow using outside of LAN". I sent out the welcome email and successfully installed the configuration into the 3CXPhone. The 3CXphone registers and appears on the management console as successfully registering.
However, when I attempt to call another extension or an outside line the response is the same: "Call failed, forbidden". Here is the log with the IPs modified for privacy. The <FQDN> is the FQDN of the 3CX system; the "192.168.0.111" is the internal IP of the remote computer the 3CXPhone is installed on. Ext 203 (remote 3CXPhone) is attempting to call the Ext 201 (local IP phone at the site of the 3CX system).
NOTE: I might add that this is happening on multiple 3CX systems when the 3CXPhone is connected outside the LAN.

11-Jan-2016 15:48:27.149 Leg L:8.1[Unknown:] is terminated: Cause: BYE from PBX
11-Jan-2016 15:48:27.099 [CM502001]: Source info: From: "Alan"<sip:203@<FQDN>>;tag=0f4bda87a1f54ed3b418426acf63138e; To: <sip:201@<FQDN>;tag3cx=e34bcc1b02584332ba59b2e09cc41646>
11-Jan-2016 15:48:27.099 [CM503013]: Call(C:8): Incoming call rejected, caller is unknown; msg=Invite-IN Recv Req INVITE from 127.0.0.1:55183 tid=Pj1bd32a3e2fc245e59abf9c385150f010 Call-ID=efe536178548464eb5c849a361674d2e:
INVITE sip:[email protected]:5060;transport=tcp;tag3cx=e34bcc1b02584332ba59b2e09cc41646 SIP/2.0
Via: SIP/2.0/TCP 127.0.0.1:5080;branch=z9hG4bK-d8754z-Pj1bd32a3e2fc245e59abf9c385150f010-2---d8754z-;rport=55183
Via: SIP/2.0/UDP xx.xx.xx.xx:58784;branch=z9hG4bK-d8754z-tunneltid-1---d8754z-;rport;tnlid=clnt.1-38e763ab53474eb6ab403e289123f68d
Via: SIP/2.0/TCP 192.168.0.111:50195;rport;branch=z9hG4bKPj1bd32a3e2fc245e59abf9c385150f010;alias
Max-Forwards: 69
Record-Route: <sip:[email protected]:5080;user=proxy;uri="clnt.1-38e763ab53474eb6ab403e289123f68d">
Contact: "Alan"<sip:[email protected]:50195;transport=TCP;rinstance=1-38e763ab53474eb6ab403e289123f68d;ob>
To: <sip:201@<FQDN>;tag3cx=e34bcc1b02584332ba59b2e09cc41646>
From: "Alan"<sip:203@<FQDN>;tag=0f4bda87a1f54ed3b418426acf63138e
Call-ID: efe536178548464eb5c849a361674d2e
CSeq: 24022 INVITE
Session-Expires: 1800
Min-SE: 90
Allow: PRACK, INVITE, ACK, BYE, CANCEL, UPDATE, INFO, SUBSCRIBE, NOTIFY, REFER, MESSAGE, OPTIONS
Content-Type: application/sdp
Proxy-Authorization: Digest username="203",realm="3CXPhoneSystem",nonce="414d535c0ca4a61a84:a308111d136a6d976cb8a9b781538872",uri="sip:201@<FQDN>;transport=tcp;tag3cx=e34bcc1b02584332ba59b2e09cc41646",response="1174a3e320508d348117d36d3a2451be",algorithm=MD5
Supported: replaces, 100rel, timer, norefersub
User-Agent: 3CXPhone for Windows 14.0.47020.0

This identical configuration worked on v12.5 but has me scratching my head on this one. Any help would be appreciated.

 

[AlanM]

After much testing and checking/unchecking boxes, the problem appears to be DNS resolution. I went into the configuration of the 3CXPhone and replaced the FQDN in the "My Location>Out of Office" field with the actual public IP address of the remote system. This corrected the issue and calls complete as they should. Now the question I am asking is why doesn't the 3CXPhone resolve the FQDN? If I ping the FQDN the address is resolved without issue. I would definitely prefer using the FQDN since my IP address is dynamically assigned. I have a total of three 3CX phone systems to which I connect: two of the three do not resolve and the "Call Failed, Forbidden" message appears; the last one of three resolves properly without issue. One works but two do not. The DDNS service is the same on the one that works and the one that does not. Any ideas as to what may be going on with the DNS or how to correct it?

 

[ian.watts]

How about Settings : Network : FQDN?
The issue isn't resolution, it's identification when SIP makes contact.
Typically I might have the reverse issue, somebody drops in the IP address when I specified FQDN in the setup. The PBX rejects the caller's identification because of it.

 

[PatrickTodd]

I've had really spotty connection using 3XCPhone on iphone over LTE, sometimes it connects jsut fine, others it endlessly attempts to register, at first I figured it was bandwidth but I am able to stream video easily so it seems to be another issue. I tested on a few home networks and got the same iffy results, sometimes working immediately, sometimes endlessly cycling. Does not appear to be a firewall related issue since sometimes it works sometimes it doesnt on the same exact networks, if firewall it should always not work I would figure.

I'll check if I am getting forbidden messages in the logs.

 

[leejor]

I went into the configuration of the 3CXPhone and replaced the FQDN in the "My Location>Out of Office" field with the actual public IP address of the remote system. This corrected the issue and calls complete as they should.

Normally, I would say that you have failed to fill in the Domain Name (FQDN) in 3CX (the PBX). It's not DNS resolution, you know that is working because the call is getting to the PBX.

 

[the4]

Hi,

I'm picking up on this thread because I have exactly the same issue and would like more information on the reason why the FQDN doesn't resolve in order to not have to change the account in each softphone.

I just made sure that I filled the Domain name with the local IP but it still doesn't work.

Thanks a lot for your help

 

[daktur]

Hi All,

It seems to be a SIP server issue over the PBX side. Try restarting all services and the 3cx phone on client side and everything should be up and running again.

I think they updated something that have created this issue.

Hope you all get good results on that and solve the problem.

 

[the4]

Hi Daktur,

Thanks a lot for the quick response. I tried to restart the services and to reprovision my softphone but it still says "Call forbidden"... Should I try putting the external IP in the "SIP Domain" field?

Otherwise, I'll have to log in to each machine and make the change to each individual softphone.

Thanks a lot for your help anyway, have a great day!

 

[NickD_3CX]

Generally if the information that the 3CXPhone apps get are incorrect, it is due to incorrect data having been input during the Installation of 3CX Phone System (actually that's where it gets everything from).

If are having these kinds of issues, the best way is to Full Backup, uninstall, re-install, restore backup, send new Welcome Emails, and just make sure that this time during the re-installation you enter everything correctly.

The most important points during the installation are:
- Write the correct Static Public IP.
- Write the correct External FQDN that points to the correct Static Public IP.
- Choose the correct DNS settings.

Starting from V14, the bear minimum you need for a fully working production system is a Static Public IP, an External FQDN (no an Internal one necessarily) and have a Static LAN IP on the server.
If you do not have an Internal FQDN, during the installation you can choose the 2nd DNS option "External FQDN and Local FQDN", for the External FQDN enter it correctly but for the Internal FQDN you can alternatively enter the Local IP of the server (will not work instead of he External FQDN though).

 

[sergiohinniger]

Hi, I have a very small office with only one trunk and the free version of the system.

I installed the v15 of the system and everything were working great, but for no reason remote outbound calls begun to get the "call failed, forbidden" prompt. I have a dynamic ip, and the phone register normally and i can receive calls outside office, but i cannot make any calls, even to exensions.

Inside office:
-Can make and receive calls

Outside office:
-Can receive calls, cannot make calls.

When i edited the account settings in my phone, by putting the actual ip from my router (that is dynamic), all start to work again. I even tried to create a noip ddns, but the result was the same.

If anyone has a solution i would like to know

 

[sergiohinniger]

I finally fixed the issue. It was a misconfiguration on FQDN tab, in the 3CX System: the "Local SIP Domain" was set to my server local IP: 192.168.1.x. When i changed to the dynamic 3cx host (in my case, _______.3cx.us) things came back to normal.
Hope that helps