5060 port failed Firewall test Fortigate

[prasad.narasimhan@hilton.]

Hi Team

recently the PBX ver 18 to 20 upgradation done from Windows to Linux
But before and after when ever did the firewall test the port 5060 keeps failing

i have contacted the Fortinet support and they did truoube shoot and couldnt fix as dont know how the FW check works
Asking more details lilke source port / destination port , traffic incoming /outgoing etc

can some one help here pls



The below one was always red in old and new version as well. No idea is this causing the issue

 

[Alphabetic]

Have you reviewed this?

https://www.3cx.com/docs/fortigate-firewall-configuration/

 

[prasad.narasimhan@hilton.]

Yes it was reviewed by team and all look normal.. they just keep asking source and destination port so that can check further and how the 3cx check works with FW

 

[NicholasP_3CX]

as dont know how the FW check works

https://www.3cx.com/docs/firewall-checker/

This outlines what the firewall check does.

 

[prasad.narasimhan@hilton.]

i have fwd to them but still unable to fix it

 

[RazaJD]

Hi Folks, did you find a solution to this?

 

[KyriacosS_3CX]

Hi,

For those tests to pass the firewall should permit incoming connections to the PBX IP+ports without limitation. Once you have the test passed you can go ahead and restrict to only allow the IPs that are relevant to you (eg SIP Trunk provider, remote offices), but if you plan to have people accessing the PBX from outside, via the mobile apps for example, then you should keep ports 5060/443 etc open from all.
The documentations already linked above should really provide all the info needed. Do check whether there is any other firewall between the Fortinet and the Internet that might be doing the blocking, if you have followed them and still you have problems.

Best,
K.

 

[NicholasP_3CX]

If only port 5060 is failing, this could mean that your ISPs router is hijacking port 5060 for some reason, or you have limited the access to port 5060 to specific IPs of your VoIP provider. We use the IPs of the STUN servers to perform the firewall test.

but if you plan to have people accessing the PBX from outside, via the mobile apps for example, then you should keep ports 5060/443 etc open from all.

The Mobile apps use 5090, not 5060.

The option to limit port 5060 traffic only affects SIP Provider traffic, unless one is using STUN to provision their phones. Bringing those through the SBC will remove this obstacle.