Connection issues with 3CX Boarder controller

[Glen3cxNZ]

Hi We are having connectivity issues with 4 of our sites connecting by 3CX border controller back to the server this morning, It appears to be since 4am that the SBC lost connection to the 3CX server.

The SBC log shows the following error

ERR | 20170626-042755.827 | 3CXTunnel | TUNL | 5872 | TunnelTcp.cpp:262 | Bridge [3CXSBC15.0.61335] failure 'TLS handshake failed: error:00000001:lib(0):func(0):reason(1)
+ (err): error:00000001:lib(0):func(0):reason(1)' on TCP connection: secure negotiation

Restarting the 3CX server or Session broker has not fixed this issue.

Has anyone else seen this issue?

Update... I have heard back from my 3CX support ticket and they investigating this internally as the issue appears to be a global one. I have provided them with some logs so I hope they will come up with a solution soon. My advise to anyone with this issue its to temporarily disable encryption from the SBC. change the SecurityMode=1 to SecurityMode=0 in the SBC config file and restart the sbc service . I suspect we will see a new SBC build soon to fix this.

I hope this has been helpful for others.

Additional Update
Here are instructions from 3CX Support for the workaround on windows and Linux

Hello all,

Here are details on how to disable the encryption so you can bypass the issue for now

Windows SBC

1. Stop the 3CX SBC Service from the Windows Services.
2. From the start menu find "Notepad", right-lick and select "Run as Administrator".
3. Find line:
   SecurityMode = 1
   and change to:
   SecurityMode = 0
4. Save the file.
5. Restart the SBC service.
6. Allow up to 10 minutes for the phone to re-register.

Debian or Raspberry Pi SBC

1. Access the SBC machine via SSH and switch to the root user.
2. Type: service 3cxsbc stop
3. Type: nano /etc/3cxsbc.conf
4. Find line:
   SecurityMode = 1
   and change to:
   SecurityMode = 0
5. Save the file by pressing Ctrl + X, then press 'y', then hit Enter.
6. Type: service 3cxsbc start
7. Allow up to 10 minutes for the phone to re-register.

We apologize for the inconvenience that his has caused you and we will try to solve this as soon as possible.

 

[cellis]

Does anyone have a guide for this workaround please?

On the SBC, edit /etc/3cxsbc.conf and change SecurityMode = 1 to SecurityMode=0. Restart the service.

 

[chaney]

Well in the same boat here. Thought there was an issue as its a new site getting setup but seems I am not alone. Disabling encryption worked.

 

[Randall]

Same. Disabling TLS worked.

 

[YiannisH_3CX]

Hello all,

Here are details on how to disable the encryption so you can bypass the issue for now

Windows SBC

1. Stop the 3CX SBC Service from the Windows Services.
2. From the start menu find "Notepad", right-lick and select "Run as Administrator".
3. Find line:
   SecurityMode = 1
   and change to:
   SecurityMode = 0
4. Save the file.
5. Restart the SBC service.
6. Allow up to 10 minutes for the phone to re-register.

Debian or Raspberry Pi SBC

1. Access the SBC machine via SSH and switch to the root user.
2. Type: service 3cxsbc stop
3. Type: nano /etc/3cxsbc.conf
4. Find line:
   SecurityMode = 1
   and change to:
   SecurityMode = 0
5. Save the file by pressing Ctrl + X, then press 'y', then hit Enter.
6. Type: service 3cxsbc start
7. Allow up to 10 minutes for the phone to re-register.

We apologize for the inconvenience that his has caused you and we will try to solve this as soon as possible.

 

[AlexDBarrett]

All hosted clients were offline this morning including ourselves when we came into work.

Having lost one client to Gamma Horizon this month due to SBC reliability I don't want to lose anymore.
Any feedback would be appreciated.

 

[DSXVOICE]

This is a confirmed issue. Please update this ticket as you have status please.

 

[Kristof Bernaert]

Same here. This is really a not done issue. I have a customer with a 24/24 dispatching phone service.
Another issue and I lose them.

https://twitter.com/ssstofff/status/879348800623607810

 

[Nathan Boyd]

Same here too. All clients with encryption enabled were offline this morning including my own office. Disabling Encryption brought it back up. For us it affected legacy clients still on V14 MultiTennant, and V15 on Linux as well.

 

[DSXVOICE]

Update: it appears as if the fix for this will require an update of the SBC install.

 

[Nathan Boyd]

I'd assume that an embedded cert in the SBC package is being updated.

 

[DSXVOICE]

Yep. New cert key.

 

[Glen3cxNZ]

Hi Everyone. Please leave comments if you find this post useful so it remains near the top of the list so others can find this post easily. Hopefully everyone getting on top of this problem.

Thanks
Glen

 

[DSXVOICE]

Hey Glen, What's the weather like there?

 

[techclarity]

Yes, it would have been nice if an e-mail went out to all partners. We spent over an hour troubleshooting the issue before opening a ticket with support, only to find out it was a 3CX issue.

 

[Glen3cxNZ]

Hey Glen, What's the weather like there?

Cold

 

[Glen3cxNZ]

Yes, it would have been nice if an e-mail went out to all partners. We spent over an hour troubleshooting the issue before opening a ticket with support, only to find out it was a 3CX issue.

How did you find out it was a 3CX issue?

 

[OCWI]

Effected 37 of our major business accounts today. Severely damaged the relationship with them - the long term results of this will surely be very expensive for my company. Not to mention the 4 hours that 14 of my employees spent running around trying to fix this.

The only reason we pay the exuberant yearly maintenance renewal fees is for the reliability of the security cert and FQDN, since we have identified those as both being single-point of failures.

Support ticket with no reply still - 10 hours ago.

My team and I completely understand technical issues happen, but how a company responds to them (and how quickly) is the measurement they should be held accountable for.

Having to go on the forums to find a workaround while dozens of multi million dollar companies remain helpless cannot be acceptable.

 

[Glen3cxNZ]

Effected 37 of our major business accounts today. Severely damaged the relationship with them - the long term results of this will surely be very expensive for my company. Not to mention the 4 hours that 14 of my employees spent running around trying to fix this.

The only reason we pay the exuberant yearly maintenance renewal fees is for the reliability of the security cert and FQDN, since we have identified those as both being single-point of failures.

Support ticket with no reply still - 10 hours ago.

My team and I completely understand technical issues happen, but how a company responds to them (and how quickly) is the measurement they should be held accountable for.

Having to go on the forums to find a workaround while dozens of multi million dollar companies remain helpless cannot be acceptable.

Hi OCWI

You mirror my thoughts completely. Unfortunately as I am from NewZealand and we are the first timezone to see this issue we had to work out the fix for ourselves with no support from 3CX or our local distributor. Neither could i find a notice on the website or a forum post. So i logged a support ticket and it took 3 hours to get a response with a request for logs , In the meantime we had found the workaround and that's why i created this post to try and help others as i knew as the rest of the world woke up they might have the same issue. One of the biggest disappointments is no notification from 3CX via email or a notice on the Support website! Simple communication could have saved a lot of time and frustration for everyone.


Glen

 

[OCWI]

Glen,

That must have been horrible. I completely empathize with what you went through this morning. Luckily, one of our VP's stumbled upon YOUR post referring to the work around. This helped point us in the right direction!

We are very grateful for your post! If you ever in the states look me up we owe ya a few cold ones.

 

[Glen3cxNZ]

Glen,

That must have been horrible. I completely empathize with what you went through this morning. Luckily, one of our VP's stumbled upon YOUR post referring to the work around. This helped point us in the right direction!

We are very grateful for your post! If you ever in the states look me up we owe ya a few cold ones.

If you follow the America's cup racing you might not be so keen as our boys just won the cup off team USA.

Pleased to help, It's good to have a forum for the 3CX users where we can help each other.

P.S I have added an option to vote that 3CX should have notified all users in the top of this post. Maybe they will listen to numbers