Best practices for remote workers without firewall access?

[604]

I have been posed a question by a client that is opening a second office, but hasn't found a suitable location yet. For now, they will likely rent a desk at a workspace/workspace environment, which has WiFi/data jack for internet, and nothing else. We won't have access to the firewall to open ports, which eliminates the STUN option, nor would it be practical to run an SBC for a mobile office worker in a public space.

We've tested the iOS mobile app, which is OK but not great: call quality is so-so, and connectivity is unpredictable when the phone joins a WiFi network. I have personally experienced incoming calls ring my phone while on public WiFi, and when I go to answer it, the call doesn't connect and is lost. Then it's a battle of trying to turn off WiFi and re-register before the caller tries again.

Is the 3CX webclient a workable (if not clunky) solution in this case? What do you guys recommend in this situation?

 

[cobaltit]

It's hard to recommend because every situation is different and some of your statements don't make sense. For one, I don't see why WiFI connectivity is unpredictable. Presumably the wifi in the work space is going to be the same connectivity as wired connectivity so unless they have a really crappy setup it should be the same experience since it's going to be a static phone. And two, I'm not sure why you would have an issue with the SBC in a public space if you are ok with a physical phone in the same space. Surely the phone is more expensive if that's what you are worried about.

Anyways, many workspace's we've used will give you the option to get your own public IP (for a fee) and to put your own network equipment in their closet (often for a fee as well). And no firewall control doesn't rule out STUN. STUN very often works fine with a single phone and while you likely won't have the only phone there, it will the only phone connecting to your customer's 3CX instance so you might get lucky. Webclient is an option although if the person has never used a web client it might be a bit of an ask. There are also phones (like Yealink) which support OpenVPN on the phone itself so you could use that to tunnel back to HQ and it would basically be a local LAN phone. Lots of options with no real recommend although I guess if you wanted to standardize the Yealink VPN option would probably the go-to.

 

[604]

Thanks for your thoughts. The WiFi may be fine at the workspace, but I can easily see this worker traveling, going to coffee shops/hotels, and using their WiFi may provide a different experience than at the workspace. Since I don't have much success myself, I find the iOS app difficult to recommend.

My experience with workspaces is limited; I did not know that workspaces offered IPs and network closet space - that is very good to know.

It will actually be two staff, not just one, so STUN may still present an issue. I guess I could test this in-house in our test network and see what happens.

The Yealink VPN idea is intriguing. Is this something that can be provisioned from 3CX, or do I need to manually configure the 2 phones, and enable OpenVPN on the 3CX server? We build Linux 3CX VPS hosted in datacentres.

 

[cobaltit]

Gotcha. Definitely understand the roaming part of the WiFi and since it would be on their phones then there isn't much you can do to stop them. You could tell your customer you can only support it in the workspace. Another option is to get some cheap Android phones as it seems 3CX works better there, at least in my experience.

For the Yealink VPN you'll have to manually configure. And you don't want to terminate the VPN on the 3CX instance itself as that's not a supported configuration. You'd want to terminate it on an edge device or in another VPS with access to the 3CX VPS.