Failing firewall tests after upgrading to v16 but everything works fine.

[TPR3CX]

Greetings,

When we deployed 3CX on v15.5, we passed all the firewall tests among all other issues. When we upgraded to v16, we now fail the firewall tests even though we did not make any changes.

Any ideas? I'm posting the output below.


resolving 'stun-us.3cx.com'... done
resolving 'stun2.3cx.com'... done
resolving 'stun3.3cx.com'... done
resolving 'sip-alg-detector.3cx.com'... done
testing 3CX SIP Server... failed (How to resolve?)

stopping service... done
detecting SIP ALG... not detected
testing port 5060... full cone test failed (How to resolve?)
starting service... done

testing 3CX Tunneling Proxy... done

stopping service... done
testing port 5090... done
starting service... done

testing 3CX Media Server... failed (How to resolve?)

stopping service... done
testing ports [9000..9398]... failed (How to resolve?)
testing port 9000... full cone test failed (How to resolve?)
testing port 9002... full cone test failed (How to resolve?)
testing port 9004... full cone test failed (How to resolve?)
testing port 9006... full cone test failed (How to resolve?)
testing port 9008... full cone test failed (How to resolve?)
testing port 9010... full cone test failed (How to resolve?)
testing port 9012... full cone test failed (How to resolve?)
testing port 9014... full cone test failed (How to resolve?)

 

[craigreilly]

What kind of Firewall?

 

[BrenttG]

Firewall is remapping the audio ports, in other words, not following consistent nat principles, depending on the firewall, this is correctable, what firewall model, and firmware version.

 

[cobaltit]

When you say you didn't make any changes, do you mean configuration changes? What about software/firmware upgrades?

 

[Haxoy]

Faced exactly the same issue (on same ports) due to this :
Firewall tests, stun-eu.3cx.com and 51.91.201.8x

 

[cobaltit]

So you restricted ports to 3CX FQDNs? That's not the default setup so it would have been helpful to include that information in your initial post. Also the firewall checker is just a tool to check for problems. It doesn't create problems where none exist. If everything works you're all good

 

[JohnS_3CX]

Are you facing issues with your 3CX system or does this refer only to the firewall checker failing?

It would also be very helpful if you described your setup as per : https://www.3cx.com/community/threads/information-to-provide-when-requesting-help.67558/

 

[Alphabetic]

Give your firewall a restart. There may be some routing issue there.

 

[TPR3CX]

FIrewalls are Cisco ASA 5525X. We passed on v15.5, but failing on v16.x. Meanwhile everything has been working fine. I was discussing this with my engineer and we would like to know what the range of IPs are for 3CX so we can make sure we have them open properly.

 

[JohnS_3CX]

I uses the 3CX STUN servers but their IPs may change from time to time.

If you are just blocking traffic from all but known source IPs then the checker will fail but will not necessarily mean it will cause you issues.

 

[TPR3CX]

Where can I find the latest IP ranges for the 3CX STUN servers? We looked an article somewhere and it mentioned just opening the ports up to the whole world which is something we're not keen to doing.

 

[SweetAction]

They don't really publish them.

Some more info:https://www.3cx.com/community/threads/firewall-tests-stun-eu-3cx-com-and-51-91-201-8x.68865/

You could always allow all, do the test, then block all. It's what we do when the client wants a bunch of green checkboxes.