Bridge over IPSec VPN using local IP

[rlynch@lockhartcadillac]

Hello,
I have two on prem 3cx servers bridged together over VPN currently, and have always been using the local IP addresses of those servers in the bridge setups since its just going over VPN. Everything has always worked great. Both are running same version 18 build right now, but I am going to have to update one of them to the very latest due to the license sync issue, license expires tomorrow so not much option. I saw a new line in the 3cx bridge notes on the 3cx site about no longer allowing bridges to connect using IP? Is this true, and when I update this one server on the slave end, is my bridge going to break? Im sure that many people connect their bridges over an IPSec vpn using the local subnet IP's on each side, if thats no longer going to be allowed, what is the best setup suggestion moving forward for those bridges over VPN? Thanks

 

[SweetAction]

Hello,
I have two on prem 3cx servers bridged together over VPN currently, and have always been using the local IP addresses of those servers in the bridge setups since its just going over VPN. Everything has always worked great. Both are running same version 18 build right now, but I am going to have to update one of them to the very latest due to the license sync issue, license expires tomorrow so not much option. I saw a new line in the 3cx bridge notes on the 3cx site about no longer allowing bridges to connect using IP? Is this true, and when I update this one server on the slave end, is my bridge going to break? Im sure that many people connect their bridges over an IPSec vpn using the local subnet IP's on each side, if thats no longer going to be allowed, what is the best setup suggestion moving forward for those bridges over VPN? Thanks

Use the FQDN and not the IP of the other PBX.

 

[rlynch@lockhartcadillac]

Use the FQDN and not the IP of the other PBX.

Thanks for the reply. I get it, they just dont use the fqdn in any way really other than for the licensing. Just IP phones, PRI, and the bridge. So i would need to setup the port forwarding, etc.. first Not a big deal though. I was just hoping to keep it all over the vpn for now, but wont know if the update will break that current bridge using IP or not. until i do it. They dont use any prescence feature over the bridge, literally just so they can call ext to ext over the bridge. Youre basically saying nix the vpn bridge by IP and instead take it out over the WAN interface using FQDN between the two pbx's is really the best and only way moving forward?

 

[SweetAction]

Thanks for the reply. I get it, they just dont use the fqdn in any way really other than for the licensing. Just IP phones, PRI, and the bridge. So i would need to setup the port forwarding, etc.. first Not a big deal though. I was just hoping to keep it all over the vpn for now, but wont know if the update will break that current bridge using IP or not. until i do it. They dont use any prescence feature over the bridge, literally just so they can call ext to ext over the bridge. Youre basically saying nix the vpn bridge by IP and instead take it out over the WAN interface using FQDN between the two pbx's is really the best and only way moving forward?

You can keep it on the VPN, just needs to be configured with the FQDN. You could edit the host file on the 2 PBXes to have the FQDN use the internal IP if you don't have a managed DNS server.

Presence has been confirmed to break if using the IP in later updates.

 

[rlynch@lockhartcadillac]

I gotcha, they dont have managed dns server at these locations. So in order to make those edits just jump on the 3cx server, open up the host file in system32, and add a line for example localserverip ourfqdn.3cx.com

Thanks

 

[SweetAction]

I gotcha, they dont have managed dns server at these locations. So in order to make those edits just jump on the 3cx server, open up the host file in system32, and add a line for example localserverip ourfqdn.3cx.com

Thanks

That would do the trick in a pinch.

 

[rlynch@lockhartcadillac]

Sounds good, thanks again for the help. Did I also read that in future updates split dns will be required for registering phones on the local lan? Instead of the local IP provisioning link option thats currently in 3cx?

 

[SweetAction]

Sounds good, thanks again for the help. Did I also read that in future updates split dns will be required for registering phones on the local lan? Instead of the local IP provisioning link option thats currently in 3cx?

That is what 3CX has stated, but I don't know if it will be possible to work around it. I suspect that a phone that ignores cert errors and that you've manually/option66 provided the https url replacing the fqdn with an IP will still work.

Why not just accept the fact you need split dns and set it up? You can likely do it for free with existing equipment.

 

[rlynch@lockhartcadillac]

That is what 3CX has stated, but I don't know if it will be possible to work around it. I suspect that a phone that ignores cert errors and that you've manually/option66 provided the https url replacing the fqdn with an IP will still work.

Why not just accept the fact you need split dns and set it up? You can likely do it for free with existing equipment.

Oh im 100% going to accept it and just setup the split DNS, was just curious as to when that was coming as requirement. Appreciate the help today.

 

[SweetAction]

Oh im 100% going to accept it and just setup the split DNS, was just curious as to when that was coming as requirement. Appreciate the help today.

Per Nick, it will be required in v20, which is the next major release. Already many things require it, like bridge presence, mobile apps, sms, and more. The best possible source I can give you for this that's public is the blog post: https://www.3cx.com/blog/releases/v20-roadmap/