5090 Tunneling and Encryption - what is the current state?

[greychain]

Has it changed since 2019?

SBC to 3CX server - Encrypted with TLS
3CX Server - 3CX Server - Encrypted with TLS (only a guess, might be wrong)
Mobile App - 3CX Server - No encryption

 

[VasilisV_3CX]

Hi @greychain,

1. SBC to 3CX server - Yes encrypted. However keep in mind that in the SBC settings >> Options >> Security, you have a choice between TLS and TCP.
2. 3CX Server - 3CX Server - I'm assuming you mean a tunneled bridge here. No, it is not.
3. Mobile App - 3CX Server - Yes it's encrypted.

 

[greychain]

I have to ask, why no encryption between 3CX servers?

When did the 3CX mobile app start using encryption?

 

[VasilisV_3CX]

Hi @greychain,

The implementation of encryption between tunneled bridges simply has not been done yet.

It's been at least 2 years ago, at the same time as when the new interface was released.

 

[greychain]

Is it in the pipeline? Customers who want to host on the cloud ask these annoying questions.

 

[NickD_3CX]

If you're hosting in the Cloud, then just make the Hardware Specs a bit bigger so bridging isn't required and all sites can connect to 1 PBX.

Also some hosting providers allow site-to-site VPNs over which you could pass the Tunnel traffic.

The reason I am saying these alternatives is because while it wil eventually happen, it isn;t on the immediate roadmap.

Remember, SBC and all Mobile Apps are encrypted Tunnel, so that is the point you should stress to the customers IMHO.

 

[greychain]

I like using the SBC as it makes managing remote extensions much easier, even on a multi segment LAN when they wont play adjust their DHCP records.

In the country I'm located in, having your PBX out of the country means all external calls are international. So it puts people off cloud hosting.

 

[Evolute IT]

If you're hosting in the Cloud, then just make the Hardware Specs a bit bigger so bridging isn't required and all sites can connect to 1 PBX.

This is not possible for everyone. 3CX does not supported timezone-aware rules nor location-based E911 (as of now, I suppose.)

This is a big problem for international customers with multiple offices. And, adjusting the hours is not an option as it takes forever (we can't even edit an hour???) and DST makes it even more painful.

Bridges are important lol but encryption on those is secondary as it uses the tunnel anyway, right?

 

[NickD_3CX]

This is not possible for everyone. 3CX does not supported timezone-aware rules nor location-based E911 (as of now, I suppose.)

This is a big problem for international customers with multiple offices. And, adjusting the hours is not an option as it takes forever (we can't even edit an hour???) and DST makes it even more painful.

Bridges are important lol but encryption on those is secondary as it uses the tunnel anyway, right?

That is precisely why I also mentioned the alternative with the site-to-site VPN....

The Tunnel used to bridge 2 PBXs is not encrypted, I can say it's "encapsulated", but not encrypted.
As opposed to the Tunnel used by SBC and Mobile Apps, that is both encapsulated and encrypted.