Solved Firewall Checker error message in 3CX PBX

[PeterCheng]

Hello sir,

We adopted 3CX as new UC solution POC recently, and right now everything seems right except th firewall checker result in 3CX web console.
Though our 3CX PBX works normallt and it seems nothing strange, but its firewall checker cannot fully pass in our environmnt.
I also have a 1-to-1 NAT for the server.
I'm wondering where the 3CX firewall checker is checking? From firewall I don't see any drop message.
Would somebody kindly tell me its mechanism for checker, what does it do? Thanks.

Peter

 

[jcostlow]

Here is a good article from 3CX on the built in firewall checker. https://www.3cx.com/docs/firewall-checker/ It uses their STUN servers to check the port forwarding and to ensure the ports aren't being remapped.

 

[PeterCheng]

Here is a good article from 3CX on the built in firewall checker. https://www.3cx.com/docs/firewall-checker/ It uses their STUN servers to check the port forwarding and to ensure the ports aren't being remapped.

Thanks a lot
So including their SIP server and Media server? The destination server will be those stun servers?


Peter

 

[Alphabetic]

Is this a sonicwall?

 

[PeterCheng]

Is this a sonicwall?

It's Palo Alto firwall, and the NAT was created as 1-to-1 NAT in the FortiADC (Load balance equipment)

 

[jcostlow]

I won't be able to help with Palo Alto as we exclusively use SonicWall for our customers. You may want to reach out to Palo Alto support for this as it could be SIP ALG or need other rules/NAT policies to avoid remapping.

 

[PeterCheng]

I won't be able to help with Palo Alto as we exclusively use SonicWall for our customers. You may want to reach out to Palo Alto support for this as it could be SIP ALG or need other rules/NAT policies to avoid remapping.

Hello jcostlow,
Thanks for your feedback.
I believe that it's our PA FW issue, becasue I can see lots of packets were dropped by our FW (it should be the test packets coming from 3CX stun server). I researched 3cx document about firewall checker test procedure, and so-called test1 was okay, test2 was failed. 3CX pbx will send request to its stun server, and it will intentionally change to another ip for the response. PA treated these response packets as abnormal behavior and then dropped them.
We will think about such behavior and how to avoid the check mechanism in the PA FW, thanks.

Peter

 

[ChrisC_3CX]

@PeterCheng
You've probably already done this but do make sure that all inbound traffic to all 3CX required ports is allowed from any source, because, as you correctly said, the firewall checker will deliberately respond from a different IP and from a different port and that is the specific test yours seems to be failing.

 

[PeterCheng]

Hello Chris,
After checking PA firewall rules and the document "https://www.3cx.com/docs/manual/firewall-router-configuration/", right now everything's fine. Firewall checker can pass successfully. Thanks for help.

Peter

 

[ChrisC_3CX]

@PeterCheng
Excellent! Glad to hear you've resolved this!

Please feel free to start a new thread should you require additional information or assistance.