Issue After Upgrading 3CX from V18.9 to V20: Firewall Checker Failing

[a.almualla]

Hello,

After upgrading my 3CX on-premises system from V18.9 to Version 20.0 Update 3 (Build 806 Release) (running on a Windows OS), I’ve encountered an issue where the Firewall Checker now fails. Prior to the upgrade, everything passed without any problems.

Setup details:

• Firewall: SonicWall NSA 5700
• Firmware: SonicOS 7.1.2-7019
• SIP ALG: Disabled
• Environment: On-premises 3CX server

Firewall Checker results:

• Testing 3CX PhoneSystem 01 SIP Server: Failed
• Detecting SIP ALG: Failed

I’ve verified using other tools on both the network and the server hosting 3CX, and SIP ALG does not seem to be active. Additionally, the Firewall Checker worked perfectly in V18.9, so I suspect the issue is related to the V20 upgrade.

Questions:

1. How can I resolve this issue to ensure the Firewall Checker passes?
2. Could this failure have any impact on voice quality or call stability?

Any advice or guidance would be appreciated!

 

[NicholasP_3CX]

The result means that the test has failed. There has either been an issue communicating with the SIP ALG detector, or the response is cut off from your firewall.

This does NOT mean you have SIP ALG on your network. Try the test again, and if it is still failing, see your firewalls logs to see if there is any dropped connections

 

[Hayward-i1]

I have had issues with my firewall checker for so long that I haven't used it in years.

It is not that there is anything wrong with the firewall checker, its that the firewall rules are so tight there is no way to get it working without changing the very rules it's trying to test. (FYI, my fire wall restricts communication to/from any IP that is not on my SIP providers list of authorised IP's).

Therefore I always have red on the dashboard under firewall! My system works just fine.

 

[a.almualla]

Thanks for the reply, everything seems to work and no SIP ALG detected. It's just annoying to see it there!
Appreciate your reply

 

[a.almualla]

The result means that the test has failed. There has either been an issue communicating with the SIP ALG detector, or the response is cut off from your firewall.

This does NOT mean you have SIP ALG on your network. Try the test again, and if it is still failing, see your firewalls logs to see if there is any dropped connections

Yes, as mentioned by you, the detector is not reaching with a reply. Things are working fine even though it still shows "failed" for the SIP ALG. Appreciate your reply, thanks!