MS Teams Direct Route SBC Inactive

[AINS Tel]

Hi All,

We are doing a Teams Integration for a customer and experiencing some issues with the Teams SBC being inactive; I have followed the Guide (https://www.3cx.com/docs/microsoft-teams-business-voice/) and the Faq (https://www.3cx.com/docs/microsoft-teams-integration-faqs/#h.nw4gx1tt7izt), see the attached screen shot.

On the server side I can see traffic on the SIP Signalling and Secure SIP ports (5062 and 5061) but still no connectivity. We had at first purchased a certificate from another vendor after checking the CA/issuer but since have tried using the recommended ssl.com Basic SSL certificate with no change...

Current certificate chain:
Certificate chain
0 s:CN = teams.########.com
i:C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com RSA SSL subCA
aKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
v:NotBefore: Aug 15 02:32:15 2023 GMT; NotAfter: Aug 14 02:32:15 2024 GMT
1 s:C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com RSA SSL subCA
i:C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
aKEY: rsaEncryption, 4096 (bit); sigalg: RSA-SHA256
v:NotBefore: Feb 12 18:48:52 2016 GMT; NotAfter: Feb 12 18:48:52 2031 GMT
2 s:C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
i:C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
aKEY: rsaEncryption, 4096 (bit); sigalg: RSA-SHA256
v:NotBefore: Feb 12 17:39:39 2016 GMT; NotAfter: Feb 12 17:39:39 2041 GMT

Traffic (ports 5060, 5061, 5062):
10:47:03.902843 IP XXX.XXX.XXX.XXX.41219 > 52.114.20.29.5061: Flags [P.], seq 168971:169532, ack 126895, win 501, options [nop,nop,TS val 3475985028 ecr 30609917], length 561
10:47:03.904743 IP 52.114.20.29.5061 > XXX.XXX.XXX.XXX.41219: Flags [P.], seq 126895:127316, ack 169532, win 16381, options [nop,nop,TS val 30625000 ecr 3475985028], length 421
10:47:03.904771 IP XXX.XXX.XXX.XXX.41219 > 52.114.20.29.5061: Flags [.], ack 127316, win 501, options [nop,nop,TS val 3475985030 ecr 30625000], length 0
10:47:03.905958 IP 52.114.20.29.27201 > XXX.XXX.XXX.XXX.5062: Flags [P.], seq 81688:82243, ack 95903, win 2050, length 555
10:47:03.905976 IP XXX.XXX.XXX.XXX.5062 > 52.114.20.29.27201: Flags [.], ack 82243, win 770, length 0
10:47:03.956347 IP XXX.XXX.XXX.XXX.5062 > 52.114.20.29.27201: Flags [P.], seq 95903:96519, ack 82243, win 770, length 616
10:47:03.980173 IP 52.114.20.29.27201 > XXX.XXX.XXX.XXX.5062: Flags [.], ack 96519, win 2048, length 0



To be clear the MS365 side of things is working and no issues:
Microsoft 365 access is properly configured. If you still feel something is wrong you can re-provision it again.
Your application id for reference is de63f991-5c77-4721-b088-20866337e8f7

Status OK. Real Time Notifications to Microsoft 365 and back are working. This means that changes from Microsoft 365 to 3CX will be updated.

Any suggestions, even for trouble shooting would be greatly appreciated.

Thanks!

 

[Alejandro_3CX]

Hi @AINS Tel please check further the ssl certificate used. The same must be generated using a Microsoft supported CA as shown here, the certificate must include the intermediary certificates and must cover the whole sbc FQDN, wildcard is not supported. This sbc fqdn must resolve the PBX Public IP address

If you are using a 3CX FQDN on the pbx, check the port 5062 TCP is open publicly without any restriction, check further the firewall rules in this document

Then run the dial plan script.

Note: your 3CX system must be using an Enterprise license key 16SC or higher.

 

[AINS Tel]

Hi @AINS Tel please check further the ssl certificate used. The same must be generated using a Microsoft supported CA as shown here, the certificate must include the intermediary certificates and must cover the whole sbc FQDN, wildcard is not supported. This sbc fqdn must resolve the PBX Public IP address

If you are using a 3CX FQDN on the pbx, check the port 5062 TCP is open publicly without any restriction, check further the firewall rules in this document

Then run the dial plan script.

Note: your 3CX system must be using an Enterprise license key 16SC or higher.

Hi Alejandro,

Thanks for the info; yes the certificate is signed by a Microsoft certified CA (in the list), the certificate includes the intermediate and root. Testing with OpenSSL, on port 5062, confirms the same (see the certificate chain posted originally). It is not a wildcard, it is teams.########.com (hashed for privacy), we are using a custom FQDN in the form of #######.ainstelecom.com.au .

Firewall is open as per the FAQ and confirmed.

License is Enterprise also.

Any thoughts?

Thanks,
Bart

 

[SweetAction]

The SSL cert, teams.#####.com, resolves to the PBX page (a record points to the same place as #######.ainstelecom.com.a )?
And ####.com is a domain registered in the customers 365 tenant (and verified)?

 

[AINS Tel]

The SSL cert, teams.#####.com, resolves to the PBX page (a record points to the same place as #######.ainstelecom.com.a )?
And ####.com is a domain registered in the customers 365 tenant (and verified)?

Hi,

Yes, both are resolving and working:

$ ping teams.########.com
PING teams.########.com (203.62.158.##) 56(84) bytes of data.
64 bytes from 203.62.158.## (203.62.158.##): icmp_seq=1 ttl=59 time=27.2 ms
64 bytes from 203.62.158.## (203.62.158.##): icmp_seq=2 ttl=59 time=28.1 ms
64 bytes from 203.62.158.## (203.62.158.##): icmp_seq=3 ttl=59 time=27.3 ms
64 bytes from 203.62.158.## (203.62.158.##): icmp_seq=4 ttl=59 time=27.0 ms
64 bytes from 203.62.158.## (203.62.158.##): icmp_seq=5 ttl=59 time=26.8 ms
64 bytes from 203.62.158.## (203.62.158.##): icmp_seq=6 ttl=59 time=28.9 ms
64 bytes from 203.62.158.## (203.62.158.##): icmp_seq=7 ttl=59 time=28.0 ms
64 bytes from 203.62.158.## (203.62.158.##): icmp_seq=8 ttl=59 time=108 ms
--- teams.########.com ping statistics ---
8 packets transmitted, 8 received, 0% packet loss, time 7011ms
rtt min/avg/max/mdev = 26.840/37.628/107.660/26.477 ms


$ ping ########.ainstelecom.com.au
PING ########.ainstelecom.com.au (203.62.158.##) 56(84) bytes of data.
64 bytes from 203.62.158.## (203.62.158.##): icmp_seq=1 ttl=59 time=33.7 ms
64 bytes from 203.62.158.## (203.62.158.##): icmp_seq=2 ttl=59 time=29.0 ms
64 bytes from 203.62.158.## (203.62.158.##): icmp_seq=3 ttl=59 time=28.7 ms
64 bytes from 203.62.158.## (203.62.158.##): icmp_seq=4 ttl=59 time=98.4 ms
64 bytes from 203.62.158.## (203.62.158.##): icmp_seq=5 ttl=59 time=27.3 ms
64 bytes from 203.62.158.## (203.62.158.##): icmp_seq=6 ttl=59 time=30.1 ms
64 bytes from 203.62.158.## (203.62.158.##): icmp_seq=7 ttl=59 time=29.4 ms
64 bytes from 203.62.158.## (203.62.158.##): icmp_seq=8 ttl=59 time=29.6 ms
--- ########.ainstelecom.com.au ping statistics ---
8 packets transmitted, 8 received, 0% packet loss, time 7011ms
rtt min/avg/max/mdev = 27.254/38.279/98.404/22.790 ms

OpenSSL request on port 5062
0 s:CN = teams.########.com
i:C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com RSA SSL subCA
aKEY: rsaEncryption, 2048 (bit); sigalg: RSA-SHA256
v:NotBefore: Aug 15 02:32:15 2023 GMT; NotAfter: Aug 14 02:32:15 2024 GMT
1 s:C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com RSA SSL subCA
i:C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
aKEY: rsaEncryption, 4096 (bit); sigalg: RSA-SHA256
v:NotBefore: Feb 12 18:48:52 2016 GMT; NotAfter: Feb 12 18:48:52 2031 GMT
2 s:C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
i:C = US, ST = Texas, L = Houston, O = SSL Corporation, CN = SSL.com Root Certification Authority RSA
aKEY: rsaEncryption, 4096 (bit); sigalg: RSA-SHA256
v:NotBefore: Feb 12 17:39:39 2016 GMT; NotAfter: Feb 12 17:39:39 2041 GMT

I am beginning to think this is something very MS (Teams) specific, unfortunately there is little that can be investigated on the MS Teams side...

Thanks,
Bart

 

[SweetAction]

And ####.com is a domain registered in the customers 365 tenant (and verified)?