Help with networking and 3CX

[danny_h]

Hi All,

I am working on setting up a remote 3CX cloud server and have some issues with networking. While setting it up at home, I have a cisco phone connected to my home router. The phone is showing up in 3CX with my Public IP and from 3CX I can reboot it remotely (via phone menu in 3CX) as well as receive/make calls, etc. Everything is working fine.

I started setting it up in the office and before adding a site-to-site VPN I just whitelisted the office IP to allow the traffic from office to remote 3CX server. The phones are able to register but somehow they are appearing in 3CX with private IPs. It seems that 3CX cannot reach the phones (tested it with reboot) and internal calling doesn't work. The office has a Verizon router connected to another linux router that does DHCP/DNS and then networking switch. The phone IPs I am seeing in 3CX are the internal IPs allocated from the Linux router but instead, I was just expecting the public IP of the office. I think this actually leads to issues. Can someone help me debug this to see what I am missing?

I plan to add a site-to-site VPN soon to have a link from office to the cloud but in the meantime, I just wanted to connect the phones to do some testing. The initial issue I had was that only 1 phone could register at a time and that came down to SIP ports. I changed it and set each phone to have a unique port (5060, 5061, 5062, etc) and that resolved the issue with registering with 3CX server but I feel that something else is missing here. Any advice will be appreciated.

Also, my public IP for any computer in the office is showing the actual public IP but for some reason phones are registering with private IPs instead. All the phones have been auto-provisioned with 3CX.

Thanks!

 

[jcostlow]

Hi Danny,

I want to make sure I read your post correctly so forgive me for asking this: At the moment there isn't a VPN?

Are the phones configured for provisioning type Direct SIP STUN?

 

[danny_h]

Hi Danny,

I want to make sure I read your post correctly so forgive me for asking this: At the moment there isn't a VPN?

Are the phones configured for provisioning type Direct SIP STUN?

You are correct, currently the is no VPN to the remote 3CX server.

I do not see "Direct SIP STUN" for provisioning the phones in the phone provisioning tab. Is it because it is not supported by the phone perhaps?

 

[jcostlow]

What kind of Cisco phone is it? You should be able to choose Direct SIP from the provisioning method drop down once you choose what phone/template and MAC address.

 

[danny_h]

What kind of Cisco phone is it? You should be able to choose Direct SIP from the provisioning method drop down once you choose what phone/template and MAC address.

View attachment 17608

I'm afraid it is a legacy phone that doesn't support it. The phone is Cisco SPA 514G. Btw, I was able to provision it through the VPN server initially.

 

[danny_h]

Also, in 3CX logs I do see: REGISTER from <Public IP> but, "Via: SIP/2.0/UDP private_ip:5071;branch=z9hG4bK-96ac35f5;received=public_ip"

 

[jcostlow]

It looks like you are correct and that phone isn't supported for STUN provisioning: https://www.3cx.com/Sip-Phones/Cisco-SPA/

 

[danny_h]

I am still not sure why and how 3CX determines which IP to use for registration: private vs public.

 

[leejor]

If you originally provisioned the set using VPN, then the set assumes it is on the same network as the server and does not care about the public IP. The set will attempt to register using it's private IP as you have not told it to use STUN, which, in your situation, it will need to use unless you use VPN, or an SBC.

 

[danny_h]

If you originally provisioned the set using VPN, then the set assumes it is on the same network as the server and does not care about the public IP. The set will attempt to register using it's private IP as you have not told it to use STUN, which, in your situation, it will need to use unless you use VPN, or an SBC.

I am not sure that is the case. All of my phones were provisioned without STUN over VPN. However, at home, the phone is getting public IP where it is connected directly to the router without VPN and in the office, it is getting private IP. The phones are identical. I wonder if because the office router has some special NAT/firewall configuration that causes it but I still don't understand how 3CX determines which IP to use for registration.

 

[leejor]

If a set is "remote", behind a router, then 3CX should be aware of the public IP the registration message is being sent from. However, it is the registration message itself, that will tell 3CX which IP to use when attempting to contact it. Normally STUN will be used by the set to determine the public IP. There may very well be something on the router, preventing this from happening.