Dropping Calls - 25% packets lost

[MICRpro]

We are having major problems with our 3CX pbx. You can connect a call but within 10-20 seconds the app indicates recovering and get the double beep - all audio dropped. it will recover after another 10 seconds. We are self hosting. I had Fortinet on the phone for hours and eliminated a few things but could not solve the problem. This is out of the blue, no changes have been made to our network or pbx. Any suggestions as where to look?

 

[TheodorosG_3CX]

This will apply to external connections only or with internal as well?
Try also the Call Quallity Tool to get a more information on which side there is networking issue.

 

[MICRpro]

This happens with both internal and external calls. When I run the call quality tool, I get event ID 10034. This event isn't on the list of 3CX explained events. In longer calls I have multiple drops and recoveries.

 

[TheodorosG_3CX]

This is network related issue as something is blocking packets.

 

[MICRpro]

Any ideas on how to troubleshoot this? I've had Fortigate look at it and they feel like the PBX is the issue.

 

[TheodorosG_3CX]

The screenshots show that this is on both direction from/to the PBX therefore this has to be checked on the local network or the NIC of the machine.

 

[MICRpro]

We are running the Debian 3CX instance on Hyper-V. We've always left the windows hyper-v firewall up (public, private and domain). I just dropped all three and still the same issue. Anything in particular to look for? I've gone over the firewall with FortiNet and it seems to be good. I'm running out of options.

 

[TheodorosG_3CX]

Is NTP installed on your HyperV machine? Check guideline here as well.

 

[MICRpro]

Yes NTP is installed. Status is n/a, but time is right.

 

[MICRpro]

I did notice this on a call with poor connection. Not sure if this helps...

 

[Guillaume Bourgeois]

Any ideas on how to troubleshoot this? I've had Fortigate look at it and they feel like the PBX is the issue.

Classic ..
That’s the kind of answer you typically get from network administrators who aren’t specialized in telephony.

Just to make sure I understand correctly, the PBX is located behind the FortiGate, right?

Validate what @TheodorosG_3CX suggested.
Otherwise, follow the procedure below.


1. Important Infrastructure and Network Checks

Windows / Hyper-V Host

Make sure only one network adapter on the physical Windows host has a default gateway.

Multiple default gateways can cause intermittent packet loss and disconnections.

3CX VM

The 3CX VM should have only one virtual network adapter.

Dedicated PBX

The VM should be dedicated exclusively to 3CX. Don’t install unrelated third-party software or services on the PBX.


FortiGate Configuration for a 3CX PBX

2. Remove the SIP Session Helper

Open the FortiGate CLI from the web interface:

config system session-helper
show

Find the entry containing:

name sip

Note its edit number and delete it.

Example if SIP is under edit 13:

config system session-helper
delete 13
end

The entry number may be different, so verify it first.


3. Disable SIP ALG / Helper

Run:

config system settings
set default-voip-alg-mode kernel-helper-based
set sip-helper disable
set sip-nat-trace disable
end

Very important: reboot the FortiGate after applying these changes.

execute reboot

Don’t skip the reboot.


4. Configure the 3CX Firewall Policy

Go to:

Policy & Objects > Firewall Policy

Create or edit the policy used by the 3CX PBX:

Incoming Interface: PBX LAN / Voice VLAN
Outgoing Interface: WAN
Source: 3CX PBX
Destination: Internet
Action: ACCEPT
NAT: Enabled as required

*Use the PBX IP address as the source.

For this policy:

Security Profiles: OFF
SSL Inspection: No Inspection
VoIP Profile: NONE

All Security Profiles must be disabled:

• Antivirus: OFF
• Web Filter: OFF
• DNS Filter: OFF
• Application Control: OFF
• IPS: OFF
• File Filter: OFF
• Email Filter: OFF

5. Verify the Firewall Policy Order

Place the dedicated 3CX policy before generic LAN-to-WAN policies.


6. Configure QoS if Required

If QoS is required, configure a Traffic Shaper:

Type: Shared
Apply Shaper: Per Policy
Traffic Priority: High

Apply it to the 3CX firewall policy and adjust the bandwidth according to the site’s Internet connection.


7. Run the 3CX Firewall Checker

Run the 3CX Firewall Checker.

It should complete successfully.

If it reports NAT or port-mapping errors, fix those before continuing.


8. Test Calls

Test several inbound and outbound calls and confirm that audio works in both directions, calls aren’t dropping unexpectedly, SIP registrations remain stable, and audio quality is normal.

After a FortiOS update, verify that the SIP Helper is still disabled and that the 3CX firewall policy still has all Security Profiles disabled.

 

[Alphabetic]

You said it's come out the blue, have you checked if the RAID on your server is ok?

Backup isnt running? obvious stuff but sometimes overlooked.

AV scans?