Firewall test failed on media server with Mapping does not match... error

[nelson house]

Hello everyone,

I've had some call quality and dropped calls issues over the past few months and now I'm digging a little deeper. I've got an up to date on prem 3CX server running on Debian, the firewall is a sonicwall TZ300 with BWM setup as well as all of the settings according to the 3cx articles. My problem is that the firewall checker fails sometimes on random media server ports with the message "testing 3CX Media Server... failed" and then the failed port will show "testing port 9024... Mapping does not match 9022. Mapping is 9088", I ran a tcpdump on the 3CX box and analyzed it with wireshark. Here is what I see:

3cx server sends out packet on port 9022 with the same "Message Transaction ID" as the next packet on port 9024, the sonicwall sends both of these packets out, and two responses come back for that exact "Message Transaction ID"

Troubleshooting points to the firewall... however... isn't the 3CX server generating the "Message Transaction ID"?

Thanks!
Dave

 

[Saqqara]

Have you followed - https://www.3cx.com/docs/sonicwall-firewall-configuration/

Paying attention to 'Disable Source Port Remap' which may require a firmware update

 

[nelson house]

Yes, definitely,

Thanks
Dave

 

[nelson house]

I guess I'm struggling with this being a firewall issue since the Message ID is being duplicated and correct me if I'm wrong that packet is being generated on the 3CX box... maybe I can't see the forest for the trees though...
Thanks,
Dave

 

[cobaltit]

Honestly I've never looked. I think the easiest thing to do is swap out the firewall with something else and test. I've never been a huge fan of Sonicwalls and if you check the forums you'll see lots of complaints with them. Pickup something like a Ubiquity USG and swap it out just to see if the firewall test is clean. If it is then you have your answer.