LAN to LAN VPN & SBC

[Philip Darnell]

Hi

We have a customer with a hosted 3CX install, using a SBC to connect to the server.

They have a second site which only has 1 phone onsite, I'd rather set it up using a SBC instead of STUN. they have a LAN to LAN VPN Connection between the two sites, would it work to set the phone on the second site using the SBC on the first site over the VPN connection?

 

[eddv123]

Hi Philip,

STUN is OK for a single remote phone (in my opinion) but for more than this can cause some challenges with audio paths and ports.

For a single phone the SBC or VPN would be a bit over-kill, you could use a Raspberry pi if you really wanted to - the main benefit being the added tunnel for security and encryption.

As for routing over the VPN connection to the SBC, you may be able to do this manually (on a networking level) however the PnP element (the ability to have the phones appearing in the interface) would not be possible.

FYI: this ability is only available on supported/preferred models: https://www.3cx.com/sip-phones/

 

[Lee Cramman]

It very much depends on the Lan to Lan setup. If it's a purely bridged configuration and both LANs are on the same subnet then I can't see why not, it should just appear as one big LAN to any networked devices.

However, if the network has routing across different subnets / IP address ranges it likely won't work, at least not without additional network configuration.

Why not just drop a factory reset phone in on the remote site and see if it gets picked up by PNP? Worst case scenario it doesn't and you have STUN as a backup.

 

[cobaltit]

So this isn't black magic, just networking. Routed or bridged doesn't matter. If you configure the extension to use the SBC, 3CX will generate the correct config. And once you get that config on the phone, it's just networking at that point. So as long as the phone can reach the SBC and there is no NAT in between it should work just fine.

 

[Philip Darnell]

Thanks for the replies.

The LAN to LAN VPN is between two Draytek Routers, they are on different subnets but I can ping the SBC from the second site, the phone arrives today so I will just try setting it up using the SBC, any issues and I'll have to set it up as STUN.

 

[lneblett]

I do not believe there would be anymore issue using the VPN with a remote SBC than there would be using a VPN with an on-premise instance of 3CX.

 

[cobaltit]

Exactly. I still work rather put a Pi at that site or configure STUN just to reduce the dependencies but that's more of a personal preference/design decision. From a technical standpoint it should work just fine.

 

[dandenson]

If you can ping the SBC from the remote site, then you can provision the phone for the SBC and it will work (provided the VPN is good and MTUs aren't wonky etc)

 

[Lee Cramman]

So this isn't black magic, just networking. Routed or bridged doesn't matter. If you configure the extension to use the SBC, 3CX will generate the correct config. And once you get that config on the phone, it's just networking at that point. So as long as the phone can reach the SBC and there is no NAT in between it should work just fine.

Thanks for the replies.

The LAN to LAN VPN is between two Draytek Routers, they are on different subnets but I can ping the SBC from the second site, the phone arrives today so I will just try setting it up using the SBC, any issues and I'll have to set it up as STUN.

You are correct except if you want to use plug and play provisioning.

If they are on different subnets then there is some sort of routing in play. That routing may or may not route broadcast requests for plug and play across subnets. In my experience with Cisco stuff then probably not as it has to be specifically enabled, this is to prevent these broadcast requests becoming overwhelming in larger networking environments.

If this is the case you can still provision, just not with PnP.

 

[cobaltit]

@Lee Cramman

You are correct. I was intentionally vague on the part about getting the config onto the phones but yes I would not expect PnP provisioning to work in this scenario,