Solved FQDN Update dynamic IP mechanism

[zacha]

Hello!

I have recently setup a 3cx instance with a dynamic public IP address and 3cx provided fqdn. Everything worked well so far, till the dynamic IP address changed. The fqdn still points to the old ip address. The ttl is 6 hours and the change occured about 48 hours ago. So I assume the change has not yet reached the 3cx DNS Server yet. The system is behind a firewall within a dmz. The connectivity is very limited due to a default deny firewalling strategy. I followed the Instructions on opening necessary Firewall exceptions but I assume the server might not be able to reach a destination for updating the address anyhow. Can anyone explain how the update mechanism is supposed to work, what it is trying to connect to and how I may observe if it is actually trying an update? Will it regularily try to update or only once after the change has occured?

Thank you

 

[craigreilly]

Settings -> Network page:
__ Dynamic Public IP (IP changes)

Do you have this selected?

 

[PhoneGnome]

You may also want to clear your own DNS cache (on your local machine).. I've had to do this a few times after the IP has changed. "Ping" your FQDN, see the IP, then clear your cache, and ping again. This often times resolves it for me.

 

[zacha]

Yes. The system is set to dynamic IP. The control panel reflects the correct IP address too. The stun servers have been made reach able though the firewall.

 

[zacha]

This is no caching issue either. Different public DNS servers still reflect the old IP.

 

[YiannisH_3CX]

Hello @zacha

Please note that the PBX must be able to get a reply from the Stun servers under Settings / Network so it will able to determine the new IP address and also be able to communicate with the 3CX activation server.

 

[zacha]

Hello YiannisH,

thank you for your reply. So 3cx does determine it's external address from the stun server's reply? I assume this works as the control panel reflects the ip address correctly. About the actication server.. the FAQ mentions it should be able to communicate with activation.3cx.com on port 443. I put *.3cx.com on the proxy whitelist but I already noticed it would make connections by opening ssl socket connections directly to IP addresses without sending SNI information when it tries to connect to the download server. I assume it is a similar issue with the activation host. I see connections to 151.80.125.88 happening. Which are denied by the proxy and which sends a *.3cx wildcard certificate on establishing a TLS session. I now allowed connections to this address just as a shot in the dark. I think the firewall requirements should be outlined more clearly.

Does the server try to update the IP address again later on?

Or do I have to trigger a change to see if it will update now?

Thanks

 

[YiannisH_3CX]

Try restarting the services of the phone system to trigger an update. If that does not work please send me a personal message with your FQDN so we can take a look on our side.

 

[zacha]

Yiannis- thanks, it works now. Actually this seems to be more or less a problem with squid which does evaluate the ssl servername AFTER evaluation of the whitelist. I now allowed 3cx to open direct socket connections to activation.3cx.com:443/tcp not a very neat solution but reasonable at least. Anyway it would be really helpful to reflect connection problems clearly in to UI/dashboard/log

 

[YiannisH_3CX]

Glad to see the issue has been resolved and thank you for updating the thread with your solution and your feedback.