Full cone Test failed. Pls help.

[MK97]

Greetings,
I am deploying a 3CX for our company. The PBX is behind a Lancom Router followed by a Sophos XG Firewall.
Both devices has forward for the ports and the firewall lets traffic go thru, I can see it in Sophos WebUI.
Problem is we can call from inbound to external, but not the other way.
But I still get the following:

• resolving 'stun-eu.3cx.com'... done
• resolving 'stun2.3cx.com'... done
• resolving 'stun3.3cx.com'... done
• resolving 'sip-alg-detector.3cx.com'... done
• testing 3CX PhoneSystem 01 SIP Server... failed (How to resolve?)
  • stopping service... done
  • detecting SIP ALG... not detected
  • testing port 5060... full cone test failed (How to resolve?)
  • starting service... done
• testing 3CX PhoneSystem Media Server... failed (How to resolve?)
  • stopping service... done
  • testing port 5090... full cone test failed (How to resolve?)
  • testing ports [9000..9398]... failed (How to resolve?)
    • testing port 9000... full cone test failed (How to resolve?)
    • testing port 9002... full cone test failed (How to resolve?)
    • testing port 9004... full cone test failed (How to resolve?)
    • testing port 9006... full cone test failed (How to resolve?)
    • testing port 9008... full cone test failed (How to resolve?)
    • testing port 9010... full cone test failed (How to resolve?)
    • testing port 9012... full cone test failed (How to resolve?)
    • testing port 9014... full cone test failed (How to resolve?)
    • testing port 9016... full cone test failed (How to resolve?)
    • testing port 9018... full cone test failed (How to resolve?)
    • testing port 9020... full cone test failed (How to resolve?)
    • testing port 9022... full cone test failed (How to resolve?)
    • testing port 9024... full cone test failed (How to resolve?)

Lancom is forwarding Port: 443,5000-5001,5060,5090,9000-9500 (TCP+UDP)
Sophos is forwading Port: 5000, 5001, 5060, 5090 TCP and 5060, 5090, 9000-9500 UDP

Is there anything I missed?

Thanks for suggestions

 

[Alphabetic]

You will need to make sure you have set up a 1:1 NAT Rule for the ports listed here.

https://www.3cx.com/docs/manual/firewall-router-configuration/