Solved Firewall: SIP ALG / Mismatched port mapping

[SVanBC]

Hi,

I'm new to the 3CX Phone System but for one of our clients, i'm setting up the VOIP environment but for some reason, the firewall test keeps failing.

Network overview:
- Client has a Dynamic IP
- B-Box3 modem (Belgium) with limited access (LAN: 192.168.X.X)
- Meraki MX65 Firewall (behind the modem, this is where the PBX is connected, LAN: 10.X.X.X)
- Meraki MX65 Firewall is configured as DMZ on the modem

1) I started off installing the latest version
2) opening the ports on the clients B-Box

3) Put the MX65 as DMZ

4) Opened the ports on the MX65 security appliance

And ran the firewall test

As you can see, all of these firewall tests, fail. I checked the solutions page but can't get it to work.

What I noticed is that when the firewall test on the 3CX server ran, there are automatically generated ports on the modem. These appears to be caused by the ALG function on the modem. As these BBox3 modems are very limited to end user, there is no possibility to disable the ALG..

My last option was to change the port the 3CX listens on, but this option appears to be greyed out in V15.

Any solutions?

Thanks in advance

Sven

 

[viraltechnology]

I hate to state an obvious question but does the ISP have any ability to disable sip ALG? Maybe look at the possibilty of hosting 3cx off-site and connecting via sbc or VPN?

 

[SVanBC]

Too bad they don't. As enduser we only get basic priviliges. We need to upgrade in order to be able to disabled the ALG. Gonna take the VPN option into account

 

[viraltechnology]

We host almost all of out installs off-site. I like that we do not have to open ports in the firewall. Using the sbc allows us to encrypt data from the sbc to the 3cx server and for the.most part it eliminates issues with Nat, SIP-AlG etc,etc

 

[complex1]

@SVanBC

Please also forward port 5060 TCP in the router and test again.

 

[SVanBC]

Thanks for the replies.
Issue is resolved, ALG was the issue.
Solution? Contacted ISP for PPPoE details and configured on the Meraki firewall to bypass SIP ALG on the modem.
Case closed

 

[viraltechnology]

glad they worked with you to get that disabled!!

 

[YiannisH_3CX]

Glad the issue has been resolved and thank you for posting your solution