Block WAN request for Hotdesk phone extension

[jmatano]

I am receiving an error on a phone that I am trying to configure on a remote site via the FQDN name saying that WAN requests are blocked. The problem is, it is a hotdesk phone. Where do I allow WAN requests for Hotdesk extensions? I know we can set it on a individual user extensions to not block WAN requests, but I would really rather provision the phones over the FQDN rather than the local IP going through the site to site VPN.

Here is the message from the logs. Anything with <> I removed the site specific info from.

SIP request (REGISTER) from <IP> was rejected. Reason: Block WAN requests is ON. Message: REGISTER sip:<OUR3CXHOSTNAME>:5060 SIP/2.0 Via: SIP/2.0/UDP <INTERNALIP>:5060;branch=z9hG4bK568277812986513678;rport=22153;received=<IP> Max-Forwards: 70 Contact: <sip:HD00293<INTERNALIP>> To: "HD00293 | HD00293" <sip:HD00293@<OUR3CXHOSTNAME:5060> From: "HD00293 | HD00293" <sip:HD00293@<OUR3CXHOSTNAME:5060>;tag=<tag>Call-ID: <CALLID>-<NUMBER>@<INTERNALIP> CSeq: 2 REGISTER Expires: 120 Allow: INVITE, ACK, OPTIONS, BYE, CANCEL, REFER, NOTIFY, INFO, PRACK, UPDATE, MESSAGE Proxy-Authorization: Digest username="7L1VfeDLNi",realm="3CXPhoneSystem",nonce="<STRING>",uri="<OUR3CXHOSTNAME:5060",response="<STRING>",algorithm=MD5 Supported: path User-Agent: Fanvil X3S 2.10.1.6836 <MAC> MAC: <MAC>Content-Length: 0

 

[Alphabetic]

Hi - what is the question?

 

[jmatano]

Hi - what is the question?

How do I let this request be allowed for a hot desked phone / extension. I don't want the WAN request blocked.

 

[Alphabetic]

Hotdesk phones can be set up in local or SBC mode - What is it you've done?

 

[jmatano]

Local but to the FQDN is how the hotdesk is set. If I set it to the direct server internal IP it works, but I want to use the FQDN.

 

[Alphabetic]

Your FQDN is resolving to your WAN address inside your LAN so your phone is going out and then in your network.
Create a DNS Zone on your DNS server for FQDN to point to internal IP of 3CX instead (or simply an A record)

 

[jmatano]

Your FQDN is resolving to your WAN address inside your LAN so your phone is going out and then in your network.
Create a DNS Zone on your DNS server for FQDN to point to internal IP of 3CX instead.

Is there a way to allow the remote site to resolve the WAN IP address? Locking it to a single IP sort of makes setting up a failover scenario difficult.

 

[Alphabetic]

Did you not just provision the phone via the 3CX Mgmt console? It will use IP address anyway when provisioning in local mode, that should be the end of setting that phone up for hot desking.

 

[jmatano]

Did you not just provision the phone via the 3CX Mgmt console? It will use IP address anyway when provisioning in local mode, that should be the end of setting that phone up for hot desking.

It's provisioned as a hotdesk phone, however it is not registered on the system under phones because of the error.

 

[Alphabetic]

In the drop down of "Select Interface" just select the IP address and leave it as that if its working that way. Otherwise, if you want to use the FQDN, create the DNS record so it's resolving internally.

 

[Saqqara]

Is there a way to allow the remote site to resolve the WAN IP address? Locking it to a single IP sort of makes setting up a failover scenario difficult.

You need to provisioning the phone as local IP or on the remote location setup a dns record for your fqdn to point to the internal 3CX server address.

Currently you have the setup using fqdn, which points to your external IP address, so in order to use the site to site VPN you need to do one of the above.

 

[jmatano]

You need to provisioning the phone as local IP or on the remote location setup a dns record for your fqdn to point to the internal 3CX server address.

Currently you have the setup using fqdn, which points to your external IP address, so in order to use the site to site VPN you need to do one of the above.

Yup, you were right, there was no way for it to go out and back in. Created a forward lookup zone in Windows DNS to the external host, and it registered right away.

Thanks all.