Do 3CX IP Phones Require Full Internet Access?

[ACL]

Hi Experts,

We have a network setup as shown in the diagram below, and we would like to seek clarification on the outbound connectivity requirements for IP phones.

Specifically:

• Do IP phones require general outbound internet access to function properly?
• Or is it sufficient to allow the IP phones to access only the 3CX FQDN?

Please note that although the IP phones are connected via Wi-Fi, this does not necessarily mean that they have internet access, as outbound traffic may be restricted by firewall policies.

We would appreciate your advice or best-practice recommendations on this.

 

[TheodorosG_3CX]

The ip phone must be able to resolve the FQDN in order to provision.
This guide will give more information to do this locally.

 

[ACL]

Our 3CX is hosted remotely in cloud, we would like to confirm again does it means that the IP phone only need to allow outbound to 3CX server on cloud and DNS server to resolve the FQDN?

 

[TheodorosG_3CX]

This apply to local installations. Since the device is remotelly it will need internet access to resolve the cloud installation over https port.

 

[ACL]

To clarify, our 3CX server is hosted in cloud. However, we would like to confirm for IP phone Setup, does it only need to allow outbound to 3CX server on cloud and DNS server to resolve the FQDN?

 

[TheodorosG_3CX]

You will need an SBC or a router phone for the provisioning.

 

[ACL]

Yes, we know IP phone need a SBC or router phone for provisioning of IP phones.
But, we would like to clarify, to provision an IP phone, do we need to allow the below at our firewall (same network with IP phones)?

• outbound access from IP phone to 3CX FQDN?
• outbound access from IP phone to all internet destination or any other destination?

 

[TheodorosG_3CX]

This is also clarified here. For provisioning you need inbound TCP.

 

[bitn2]

The phones need access to the internet to get the time from the configured time server (depends on the phone). To use RPS you need as well internet access. If you want to restrict the phones down to the pbx, be sure to configure your own time server and allow access to the pbx in and outbound as mentioned in the firewall configuration manual.

 

[ACL]

The phones need access to the internet to get the time from the configured time server (depends on the phone). To use RPS you need as well internet access. If you want to restrict the phones down to the pbx, be sure to configure your own time server and allow access to the pbx in and outbound as mentioned in the firewall configuration manual.

Hi Expert,

Does the phone need to connect back to RPS all the time? Or, it is only needed for first time provisioning?

 

[bitn2]

Hi Expert,

Does the phone need to connect back to RPS all the time? Or, it is only needed for first time provisioning?

Its only for the first automatic provisioning.

 

[ACL]

Thank you so much for your clear clarification!

 

[Alphabetic]

You'll need 443/5001 for changes like blf keys iirc