Solved Activating license failing

[PJTech]

I'm looking for some help understanding the network requirements to activate the license.

3CX version: Standard Annual 18.0 Update 2 build 314 (recent update from V16.)
Server: on prem Debian 10, no SBC
Phones: local phones on LAN only, no remote phones
SIP trunk: My ISP hands me an ethernet drop with SIP in my data center, completely separate from our WAN stack.

History
Over summer we merged with a larger company and our entire WAN got put behind an SDWAN solution, going through outbound proxy and outbound SSL inspection etc. I also went from solo IT controlling the entire stack, to part of a much larger team, with Network and Security teams at corporate I'm working with to resolve this. I upgraded 3CX from V16 to V18 last week and that must have triggered a license activation check, which is now failing, "unable to reach 3CX License Activation Server. Confirm that your Primary DNS Server is able to resolve activate.3cx.com" This must be the first check since our entire WAN stack changed since we were cruising along fine post-merger before the update. So we are limping along with no BLF, etc.

Troubleshooting

• DNS is not the issue here (famous last words). Solid DNS with nslookup properly getting results for activate.3cx.com
• Our FQDN properly resolves to the static IP I have set in the 3CX configuration (but that IP does not have any port mapping to the 3CX box for security reasons since we do not need any remote phone/3CX access. Even before merger I didn't have outside ports mapped from public IP to 3CX)
• Working with network and security teams, we have all outbound traffic inspection turned off coming from the 3CX box, and making sure nothing else appears to be . (but the public IP this traffic appears from is not the same IP as the FQDN, and it can change by the minute)
• Searched these forums high and dry. Most results were DNS related, but a few mentioned DPI/proxy could be getting in the way, which I think I mitigated...

So what exactly is needed when I click the renew license button, the packet gets sent out to activate.3cx.com and then returns...how? The same TCP stream the request came from? Back via the configured FQDN? I also respect the magic sauce around license activation so I can work via direct messages etc. if needed. I'm looking for either the missing magic bullet, or at least help understanding what's needed so I can further dig with my network and security teams.

Thank you!

 

[SweetAction]

It sounds like you have done a fair bit of troubleshooting. I can only offer this bit of advice, as stupid as it's going to sound.

Likely you are using an internal dns resolver (as you should). If so, set the DNS on the 3CX box to 8.8.8.8 and reboot, then try again.

I can't put my finger on it, but I've run into this issue and that was the fix. And yes, I could nslookup and get valid results back when I've run into this issue. I suspect the PBX looks for something DNS related (not an A record, etc) and some DNS servers don't pass it back. I was going to sniff it out one day but ran into some SSL bumping issues. I suspect some sort of Key Pinning is in use.

 

[PJTech]

SweetAction - that did it! I'm standing here with my jaw dropped at yet again, it's DNS. We have a pretty solid internal DNS resolver so it wasn't on my radar. I put in 8.8.8.8 and 8.8.4.4 above my internal DNS and we're back in business.

Thank you for your insight!

 

[VasilisV_3CX]

Hi @PJTech, great to hear you've resolved this, feel free to open a new thread if you require any further assistance.