Internal 3CX Server without Access from Internet

[DolbySR05]

Hi there!

I was wondering whether it is possible to run a 3CX server in an "Intranet-Environment". The server would get an internal IP, an internal FQDN which can be resolved throughout the entire company, can get an internal valid certificate (so self-sign certificates), has access to the internet using HTTP/S but won't be reachable from the internet (security issues). Does this pose a threat to licensing or updates?

Regards
Patrick

 

[JohnS_3CX]

Hi Patrick,

The system needs to communicate with the activation server otherwise you will not be able to activate or maintain the activation.

 

[DolbySR05]

Hi John

The system would be free to communicate with the internet and therefore an activation server. There won't be any NAT rules installed to allow a direct access from the internet to the PBX however. Is that an issue?

Regards
Patrick

 

[JohnS_3CX]

If the updates and activation servers are reachable then you should be ok, if you are only blocking incoming connections.

It's still a good idea to run a test deployment first in the intended environment and use it as a proof of concept to ensure you will not have issues.

I imagine you will have open routes to your trunk provider (or a dedicated SIP connection directly with them) and that you will have some way to remotely reach the server via a VPN in order to manage it. Just some things to consider..

 

[benf]

Hi John

The system would be free to communicate with the internet and therefore an activation server. There won't be any NAT rules installed to allow a direct access from the internet to the PBX however. Is that an issue?

Regards
Patrick

How would you bring in SIP? You could use a T1/SIP converter I suppose and program 3CX manually? I have debated doing that in some of our HA enviornments to have a T1 for backup, never tried it though.

 

[cobaltit]

@DolbySR05

Just to make your life easier I would recommend getting a 3CX FQDN and then just adding that zone/record to your internal DNS for internal resolution. Less management needed.