Firewall check fails on Azure. ALG detected

[datamerge]

Hi all

I have done stacks of 3CX implementations on AWS without issues. I thought I would run up the new 16 alpha on my Azure account to see how it goes.

I used PBXEpress to install it and it is all working fine, but it fails the firewall check due to detecting ALG. I cannot see any sign of ALG on the Azure firewall (which is really just a basic TCP/UCP filter).

Has anyone experience with this and successfully completed the firewall check on Azure?

 

[eddv123]

I too am an AWS user and have never had any of these issues.

If Azure is anything like AWS and just contains simple filters (security groups in AWS) then I cannot even recall anything SIP ALG related in the configuration.

A quick Google search produced this string:https://stackoverflow.com/questions/20403886/azure-vm-cant-receive-incoming-sip-request

Worth checking this "Enable direct server return setting" if you have it on.

 

[datamerge]

Ok thanks. I'll check that and report back. The trunk works fine both ways.

 

[eddv123]

OK, are you actually experiencing an issue at all ? if the trunks are working and calls flow then the ALG should not be having an effect.

Like a media proxy all SIP and RTP packets are sent to an ALG then their respective destinations. The ALG also works with NAT by changing the IP details in the SIP message as required - the main reason it is recommended to be disabled when using with 3CX.

 

[datamerge]

Yes I know how ALG works. I am specifically interested to know if anyone has had an issue with firewall checker on Azure. The ALG checker works by check summing the SIP payload it sends to the 3cx check server and comparing that checksum to what is returned by the 3cx server. The issue could be something like the Azure virtual NIC driver pads out the payload with an extra hex 0, so there will be a disparity and a failure. I can't use this in production even if it works as it is unsupported by 3cx.

 

[datamerge]

Well that's interesting. I just ran it again today. I have made no changes, but it worked.