Solved Direct SIP Question

[ipt_dude]

We are running the latest version of Debian 3CX - 18.0 (Build 461). We have an integration with Flowroute for our PSTN connectivity.

Would it be beneficial, from a security perspective, to disable Direct SIP. In the 3CX MC, under Settings >> Network >> FQDN - we have Settings for Direct SIP Call enabled to Allow calls from/to external SIP URIs. I assume this is the default setting because I don't recall enabling it.

TIA

 

[VasilisV_3CX]

Hi @ipt_dude,

Would it be beneficial, from a security perspective, to disable Direct SIP

Yes, if you're not using it then it would be beneficial to disable it.

 

[ipt_dude]

Hi @ipt_dude,


Yes, if you're not using it then it would be beneficial to disable it.

Hi V,

How would we, in theory, use this feature?

We have clients who call our DIDs hosted on Flowroute. We have some staff who use the 3CX web client, 3CX smartphone app and some users with 3CX SBCs and Yealinks at home.

TIA

 

[VasilisV_3CX]

Hi @ipt_dude,

How would we, in theory, use this feature?

We have a great document outlining direct SIP here: https://www.3cx.com/docs/direct-sip/ which I think will be far more beneficial to you than me typing out a document. If you need anything else, feel free to let me know.

 

[Rich_RJM]

Direct SIP can be best understood via this 3CX article:
https://www.3cx.com/blog/voip-howto/direct-sip/

When using the PBX with a provider like Flowroute (or any SIP provider), Direct SIP should not be needed, and you can turn it off if you want.

As the article states, direct SIP is like email in a way, it allows other callers to find you and your system based on your URL and extension, allowing you to bypass a SIP provider like Flowroute to make calls (calls are made directly between caller and callee).

 

[ipt_dude]

Hi @ipt_dude,


We have a great document outlining direct SIP here: https://www.3cx.com/docs/direct-sip/ which I think will be far more beneficial to you than me typing out a document. If you need anything else, feel free to let me know.

Yep - I already saw that and that is why I posted this thread.

What I'm tying to understand is if our standard business is accepting PSTN calls from our clients through our Flowroute DIDs - then we should disable this feature because no one should be attempting to "CALL" directly to our 3CX FQDN via Direct SIP.

Is my general understanding correct?

 

[ipt_dude]

Direct SIP can be best understood via this 3CX article:
https://www.3cx.com/blog/voip-howto/direct-sip/

When using the PBX with a provider like Flowroute (or any SIP provider), Direct SIP should not be needed, and you can turn it off if you want.

As the article states, direct SIP is like email in a way, it allows other callers to find you and your system based on your URL and extension, allowing you to bypass a SIP provider like Flowroute to make calls (calls are made directly between caller and callee).

Perfect. That is what I was looking for.

Frankly, I'm a little surprised that this feature is enabled by default.

Thank you very much and this thread is good to be closed.

 

[VasilisV_3CX]

What I'm tying to understand is if our standard business is accepting PSTN calls from our clients through our Flowroute DIDs - then we should disable this feature because no one should be attempting to "CALL" directly to our 3CX FQDN via Direct SIP.

Is my general understanding correct?

The way this works in essence is that if anyone who uses a device that supports direct SIP (i.e not an analog line) and they have your username@domain, will be able to create calls directly between themselves and your PBX without needing to route via your provider.

So from a security standpoint, disabling this would mean people wouldn't have the option to try to connect to using this method and in the long run that may be a good thing.

 

[leejor]

Some people also enable this feature when using the SIP ID, set against extensions. This allows things like dialing zero, for an operator, or dialing a full DID number, and having it call direct to an extension, without using an outbound route..

 

[ipt_dude]

The way this works in essence is that if anyone who uses a device that supports direct SIP (i.e not an analog line) and they have your username@domain, will be able to create calls directly between themselves and your PBX without needing to route via your provider.

So from a security standpoint, disabling this would mean people wouldn't have the option to try to connect to using this method and in the long run that may be a good thing.

Awesome. Great forum support as always. 3CX trumps Cisco CUCM always!

 

[ipt_dude]

Some people also enable this feature when using the SIP ID, set against extensions. This allows things like dialing zero, for an operator, or dialing a full DID number, and having it call direct to an extension, without using an outbound route..

Ah - Leejor to the rescue again!

So we definitely use SIP IDs for dialing zero. Too bad that this process couldn't be disabled for WAN side connections and left enabled for LAN side.

Looks like we will have to keep it enabled for now.

 

[VasilisV_3CX]

Glad we got to the bottom of it @ipt_dude, if you need anything else feel free to open a new thread!