New 3CX system Install... I am stuck :)

[lploscar]

Good Morning Gents,

So, I am quite new at this and got stuck after successfully configuring my router/firewall to properly pass the VoIP traffic...
Please see below the capture from the firewall checker, and the Server logs... The SIP trunk registers just fine.
I am not able to dial out from the 3CX softphone, and incoming calls (from landlines/cells) are terminated when I answer...
Thank you in advance for your help!

Luc

 

[davidbenwell]

Hi you are getting an error of No RTP packets were received

This could be either a local firewall issue or config issue.

Also you appear to have an out of office rule set within the phone extension

 

[lploscar]

Hey David,

Thanks for your reply! So, I see the error you are talking about, but I have no FW enabled on the server that hosts the 3CX system... and, I am passing the FW checker with flying colors
Also, I have double-checked the configuration of the Extension 101... no Out of Office rule is set.

When I try to dial out to a landline, I get the following:

14:19:38.623 [CM503016]: Call(5): Attempt to reach <sip:[email protected]:5060> failed. Reason: Not Acceptable HereReason Unknown
14:19:38.623 [CM503003]: Call(5): Call to sip:[email protected]:5060 has failed; Cause: 488 Not acceptable here; from IP:196.38.164.132:5060
14:19:37.951 [CM503025]: Call(5): Calling VoIPline:0117755000@(Ln.10001@Switchtel01)@[Dev:sip:[email protected]:5060]
14:19:37.810 [CM503003]: Call(5): Call to sip:[email protected]:5060 has failed; Cause: 488 Not acceptable here; from IP:196.38.164.132:5060
14:19:36.919 [CM503025]: Call(5): Calling VoIPline:0117755000@(Ln.10000@Generic SIP Trunk -)@[Dev:sip:[email protected]:5060]
14:19:36.779 [CM503004]: Call(5): Route 2: VoIPline:0117755000@(Ln.10001@Switchtel01)@[Dev:sip:[email protected]:5060]
14:19:36.779 [CM503004]: Call(5): Route 1: VoIPline:0117755000@(Ln.10000@Generic SIP Trunk -)@[Dev:sip:[email protected]:5060]
14:19:36.779 [CM503010]: Making route(s) to <sip:[email protected]:5060>
14:19:36.763 [CM505001]: Ext.101: Device info: Device Not Identified: User Agent not matched; Capabilities:[reinvite, replaces, able-no-sdp, recvonly] UserAgent: [3CXPhone 5.0.14900.0] PBX contact: [sip:[email protected]:5060]
14:19:36.763 [CM503001]: Call(5): Incoming call from Ext.101 to <sip:[email protected]:5060>

Thank you for your help!

 

[davidbenwell]

488 Error - maybe a provider issue.

Can you confrim that, you only have 1 Router, and 3CX is also local to the phones (Same local subnet)

 

[lploscar]

Thank you for your reply... Yes, I have one server in this office (no fire/wall, and AV disabled) and a Cisco 871... this is directly connected to the Internet/ISP... The VoIP provider is from South Africa (switchtel.co.za), and I am trying to setup this SIP trunk connection for people in CH to dial "locally" in SA. The 3CX System is on the same subnet as the Router (and, so is the 3CX soft-phone configured on my machine).

Thank you,

Luc

 

[eagle2]

Cisco routers like 871 are SIP ALG compatible. 3CX generally recommends disabling of SIP ALG feature. However Cisco routers are functioning correctly, so disabling SIP ALG is not a must.

I will suggest that you configure static NAT between public IP address and local IP address of 3CX server (or at least port based NAT - UDP 5060, 5090, 9000-9049; TCP 5090). You should afterwords disable STUN in 3CX server, as STUN is generally not compatible with SIP ALG capable routers / symmetric NAT environments.

Proper understanding of your router operations is crucial for correct 3CX functioning.

Regards

 

[lploscar]

Thank you for your reply...I went ahead and turned off the ALG (SIP) feature on the Cisco 871, and the result was the same as above... the Ports are correctly mapped through the Router (static NAT for all that you have enumerated), as the FW checker (above) shows. I have also tried disabling the STUN, to no avail...
Here is the result of the "debug ip nat sip" command:

000665: Jun 22 09:59:26.477: NAT: SIP: Trying to find expires parameter
000666: Jun 22 09:59:26.477: NAT: SIP: [1] register:0 door_created:0
000667: Jun 22 09:59:26.477: NAT: SIP: [1] register:0 door_created:0
000668: Jun 22 09:59:26.581: NAT: SIP: [0] processing SIP/2.0 404 Not Found message
000669: Jun 22 09:59:26.581: NAT: SIP: [0] register:0 door_created:0
000670: Jun 22 09:59:26.581: NAT: SIP: [0] translated embedded address 192.168.5.5->xx.xx.xx.xx
000671: Jun 22 09:59:26.581: NAT: SIP: [0] register:0 door_created:0
000672: Jun 22 09:59:26.581: NAT: SIP: [0] register:0 door_created:0
000673: Jun 22 10:00:05.754: NAT: SIP: [1] processing OPTIONS message
000674: Jun 22 10:00:05.758: NAT: SIP: [1] translated embedded address xx.xx.xx.xx->192.168.5.5
000675: Jun 22 10:00:05.758: NAT: SIP: [1] register:0 door_created:0
000676: Jun 22 10:00:05.758: NAT: SIP: [1] register:0 door_created:0
000677: Jun 22 10:00:05.758: NAT: SIP: [1] register:0 door_created:0
000678: Jun 22 10:00:05.758: NAT: SIP: [1] translated embedded address xx.xx.xx.xx->192.168.5.5
000679: Jun 22 10:00:05.758: NAT: SIP: [1] register:0 door_created:0
000680: Jun 22 10:00:05.758: NAT: SIP: Contact header found
000681: Jun 22 10:00:05.758: NAT: SIP: Trying to find expires parameter
000682: Jun 22 10:00:05.758: NAT: SIP: [1] register:0 door_created:0
000683: Jun 22 10:00:05.862: NAT: SIP: [0] processing SIP/2.0 200 OK message
000684: Jun 22 10:00:05.862: NAT: SIP: [0] register:0 door_created:0
000685: Jun 22 10:00:05.862: NAT: SIP: Contact header found
000686: Jun 22 10:00:05.862: NAT: SIP: Trying to find expires parameter
000687: Jun 22 10:00:05.862: NAT: SIP: [0] translated embedded address 192.168.5.5->xx.xx.xx.xx
000688: Jun 22 10:00:05.862: NAT: SIP: [0] register:0 door_created:0
000689: Jun 22 10:00:05.862: NAT: SIP: [0] translated embedded address 192.168.5.5->xx.xx.xx.xx
000690: Jun 22 10:00:05.862: NAT: SIP: [0] register:0 door_created:0
000691: Jun 22 10:00:05.862: NAT: SIP: [0] register:0 door_created:0
000692: Jun 22 10:00:08.046: NAT: SIP: [0] processing INVITE message
000693: Jun 22 10:00:08.046: NAT: SIP: [0] translated embedded address 192.168.5.5->xx.xx.xx.xx
000694: Jun 22 10:00:08.046: NAT: SIP: [0] register:0 door_created:0
000695: Jun 22 10:00:08.046: NAT: SIP: Contact header found
000696: Jun 22 10:00:08.046: NAT: SIP: Trying to find expires parameter
000697: Jun 22 10:00:08.046: NAT: SIP: [0] register:0 door_created:0
000698: Jun 22 10:00:08.046: NAT: SIP: [0] message body found
000699: Jun 22 10:00:08.046: NAT: SIP: Media Lines present:1
000700: Jun 22 10:00:08.046: NAT: SIP: Translated m= (xx.xx.xx.xx, 9002) -> (xx.xx.xx.xx, 9002)
000701: Jun 22 10:00:08.050: NAT: SIP: old_sdp_len:277 new_sdp_len :277
000702: Jun 22 10:00:08.290: NAT: SIP: [1] processing SIP/2.0 407 Proxy Authentication Required message
000703: Jun 22 10:00:08.290: NAT: SIP: [1] translated embedded address xx.xx.xx.xx->192.168.5.5
000704: Jun 22 10:00:08.290: NAT: SIP: [1] register:0 door_created:0
000705: Jun 22 10:00:08.290: NAT: SIP: [1] register:0 door_created:0
000706: Jun 22 10:00:08.294: NAT: SIP: [0] processing ACK message
000707: Jun 22 10:00:08.294: NAT: SIP: [0] translated embedded address 192.168.5.5->xx.xx.xx.xx
000708: Jun 22 10:00:08.294: NAT: SIP: [0] register:0 door_created:0
000709: Jun 22 10:00:08.394: NAT: SIP: [0] processing INVITE message
000710: Jun 22 10:00:08.394: NAT: SIP: [0] translated embedded address 192.168.5.5->xx.xx.xx.xx
000711: Jun 22 10:00:08.398: NAT: SIP: [0] register:0 door_created:0
000712: Jun 22 10:00:08.398: NAT: SIP: Contact header found
000713: Jun 22 10:00:08.398: NAT: SIP: Trying to find expires parameter
000714: Jun 22 10:00:08.398: NAT: SIP: [0] register:0 door_created:0
000715: Jun 22 10:00:08.398: NAT: SIP: [0] message body found
000716: Jun 22 10:00:08.398: NAT: SIP: Media Lines present:1
000717: Jun 22 10:00:08.398: NAT: SIP: Translated m= (xx.xx.xx.xx, 9002) -> (xx.xx.xx.xx, 9002)
000718: Jun 22 10:00:08.398: NAT: SIP: old_sdp_len:277 new_sdp_len :277
000719: Jun 22 10:00:08.642: NAT: SIP: [1] processing SIP/2.0 488 Not acceptable here message
000720: Jun 22 10:00:08.642: NAT: SIP: [1] translated embedded address xx.xx.xx.xx->192.168.5.5
000721: Jun 22 10:00:08.642: NAT: SIP: [1] register:0 door_created:0
000722: Jun 22 10:00:08.642: NAT: SIP: [1] register:0 door_created:0
000723: Jun 22 10:00:08.646: NAT: SIP: [0] processing ACK message
000724: Jun 22 10:00:08.646: NAT: SIP: [0] translated embedded address 192.168.5.5->xx.xx.xx.xx
000725: Jun 22 10:00:08.646: NAT: SIP: [0] register:0 door_created:0
000726: Jun 22 10:00:10.521: NAT: SIP: [1] processing NOTIFY message

*xx.xx.xx.xx is the Public IP
Thank you,

 

[eagle2]

Hi,

are you sure the your provider is OK (just reading the post above) ?

I have a customer having Cisco 871 with SIP ALG on and one static public IP address.
The 3CX is on the LAN (10.10.10.0/24) and I have configured static NAT like this:

ip nat inside source static udp 10.10.10.11 5060 interface FastEthernet4 5060
ip nat inside source static tcp 10.10.10.11 5090 interface FastEthernet4 5090
ip nat inside source static udp 10.10.10.11 5090 interface FastEthernet4 5090
ip nat inside source static udp 10.10.10.11 9000 interface FastEthernet4 9000
ip nat inside source static udp 10.10.10.11 9001 interface FastEthernet4 9001
ip nat inside source static udp 10.10.10.11 9002 interface FastEthernet4 9002
...
ip nat inside source static udp 10.10.10.11 9049 interface FastEthernet4 9049

The Cisco router is also NAT-ing the LAN (10.10.10.0/24) to the public address for all other devices.
Check also the access lists in the router – could the firewall settings being blocking the traffic ?.


I have disabled STUN in 3CX server and I'm using instead of it the external static address.
I have three VoIP providers registered without using STUN, one of them is international SIPtraffic (a Betamax brand) – used only for outgoing calls.


I have several 3CX sofphones on the local LAN and several Linksys SPA phones, as well as external 3CX softphones (using 3CX tunnel) and other IP phones (Linksys, registering to public address of the router). I'm running 3CX version 10 SP1.1.

Generally STUN on 3CX server is important for registering to VoIP providers only (and I'm not using it).
Port forwarding on the router is important for remote phone and eventually for incoming calls from providers (if firewall hole expired or no periodic registrations are sent to them – this should happen to port 5060 only, RTP could be to other ports).

As I have chosen 'ALLOWSOURCEASOUTBOUND' set to '1' in 3CX server parameters, I'm also not using STUN neither on internal nor on external IP phones. Please note that internal phones (i.e. on the LAN) using STUN will not operate correctly – you should be able to see them registering into 3CX server with local address, not with public one.

All these settings are working fine for me.

 

[lploscar]

Thanks again for your help!

So, I will start from the top:
- I have the 3CX system on the same LAN as the router
- STUN disabled and using the Public IP
- Router config is attached
- Also NAT'ing to the Public for the rest of the devices
- 1 Provider, and it registers just fine (green status)
- 1 3CX soft-phone that I have auto-provisioned from the 3CX system (even if I take the STUN setting out, it reappears somehow)
- soft-phone does register with the Private IP (see below)
- 3CX System version same as yours
- I cannot find where to set the 'ALLOWSOURCEASOUTBOUND' to '1'

Outbound calls still fail as follows:


14:54:47.076 [CM503016]: Call(13): Attempt to reach <sip:[email protected]:5060> failed. Reason: Not Acceptable HereReason Unknown
14:54:47.061 [CM503003]: Call(13): Call to sip:[email protected]:5060 has failed; Cause: 488 Not acceptable here; from IP:196.38.164.132:5060
14:54:46.405 [CM503025]: Call(13): Calling VoIPline:0117755000@(Ln.10000@SwitchTel)@[Dev:sip:[email protected]:5060]
14:54:46.326 [CM503004]: Call(13): Route 1: VoIPline:0117755000@(Ln.10000@SwitchTel)@[Dev:sip:[email protected]:5060]
14:54:46.326 [CM503010]: Making route(s) to <sip:[email protected]:5060>
14:54:46.311 [CM505001]: Ext.101: Device info: Device Not Identified: User Agent not matched; Capabilities:[reinvite, replaces, able-no-sdp, recvonly] UserAgent: [3CXPhone 6.0.19548.0] PBX contact: [sip:[email protected]:5060]
14:54:46.311 [CM503001]: Call(13): Incoming call from Ext.101 to <sip:[email protected]:5060>
14:52:12.587 [CM504001]: Ext.101: new contact is registered. Contact(s): [sip:[email protected]:53329;rinstance=abbd1d2c84c180d2/101]


I really appreciate your help! I am trying to get in touch with some tech support from the SIP Trunk Provider, also.

Luc

 

[eagle2]

Hi Luc,

I still don't have a clear idea what could be the problem. This seems to be a router issue.

1. Is firewall check passing successfully ? This is in 'Settings' menu of 3CX server, you need to stop the 3CX Windows service before.

2. Can you register the 3CX softphone (or other SIP device) to your provider directly, without using the 3CX server and make and receive calls ?

3. If you have 2 or more extensions in your 3CX (softphones, etc.) on your LAN can they complete successfully calls between them?

3CX softphone use STUN server only if you select 'Out of the office' as address of your IP PBX. STUN should be disabled for other SIP phones (hardware ones, etc.) on your LAN, as if they register into the 3CX server with your public address, you will not be able to make and receive calls, nevertheless they will appear registered. The 'ALLOWSOURCEASOUTBOUND' parameter is in 'Settings | Advanced | Custom Parameters' and is set to '1' by default in Version 10. This is not important right now, but useful for external phones.

4. I'm not an expert on Cisco routers, nevertheless I'm able to configure them mostly. I would advise to check the configuration thoroughly, especially if the 3CX firewall checker is giving warnings or errors (Point 1).
You should have outgoing and incoming access-lists something like these:

access-list 100 permit ip 10.10.10.0 0.0.0.255 any
access-list 101 permit ip xx.yy.zz.0 0.0.0.255 any

In your case access-list 100 (or similar number) should allow access from your LAN 192.168.5.0 to outside world, while access-list 101 (or similar number) should permit traffic from your VoIP provider (xx.yy.zz.0 is the provider's address / network). While the outgoing access-list is most probably in place, you must check the incoming one (if you have configured the router with SDM tool, most probably the traffic is blocked). There should be a record like:

interface FastEthernet4
ip access-group 101 in

5. How you disabled the SIP ALG in the router ? I will suggest to enable it (Cisco is doing fine) and try again.

6. Try to capture traffic with wireshark to see what's happening between the router (WAN port) and the provider. Apply 'SIP or RTP' filter. You need a HUB or Mirror Switch in front of your Cisco router, even you don't have another public address (for the PC running wireshark).

Can you check and answer these questions ?

Best regards,
Orlin.

 

[lploscar]

Hey Orlin,

Thanks again for the helping hand!

1. Firewall checker:

3CX Firewall Checker, v1.0. Copyright (C) 3CX Ltd. All rights reserved.

<16:26:04>: Phase 1, checking servers connection, please wait...
<16:26:04>: Stun Checker service is reachable. Phase 1 check passed.
<16:26:04>: Phase 2a, Check Port Forwarding to UDP SIP port, please wait...
<16:26:05>: UDP SIP Port is set to 5060. Response received correctly with no translation. Phase 2a check passed.

<16:26:05>: Phase 2b. Check Port Forwarding to TCP SIP port, please wait...
<16:26:05>: TCP SIP Port is set to 5060. Response received correctly with no translation. Phase 2b check passed.

<16:26:05>: Phase 3. Check Port Forwarding to TCP Tunnel port, please wait...
<16:26:05>: TCP TUNNEL Port is set to 5090. Response received correctly with no translation. Phase 3 check passed.

<16:26:05>: Phase 4. Check Port Forwarding to RTP external port range, please wait...
<16:26:11>: UDP RTP Port 9000. Response received correctly with no translation. Phase 4-01 check passed.
<16:26:11>: UDP RTP Port 9001. Response received correctly with no translation. Phase 4-02 check passed.
<16:26:11>: UDP RTP Port 9002. Response received correctly with no translation. Phase 4-03 check passed.
<16:26:11>: UDP RTP Port 9003. Response received correctly with no translation. Phase 4-04 check passed.
<16:26:11>: UDP RTP Port 9004. Response received correctly with no translation. Phase 4-05 check passed.
<16:26:11>: UDP RTP Port 9005. Response received correctly with no translation. Phase 4-06 check passed.
<16:26:11>: UDP RTP Port 9006. Response received correctly with no translation. Phase 4-07 check passed.
<16:26:11>: UDP RTP Port 9007. Response received correctly with no translation. Phase 4-08 check passed.
<16:26:11>: UDP RTP Port 9008. Response received correctly with no translation. Phase 4-09 check passed.
<16:26:11>: UDP RTP Port 9009. Response received correctly with no translation. Phase 4-10 check passed.
<16:26:11>: UDP RTP Port 9010. Response received correctly with no translation. Phase 4-11 check passed.
<16:26:11>: UDP RTP Port 9011. Response received correctly with no translation. Phase 4-12 check passed.
<16:26:11>: UDP RTP Port 9012. Response received correctly with no translation. Phase 4-13 check passed.
<16:26:11>: UDP RTP Port 9013. Response received correctly with no translation. Phase 4-14 check passed.
<16:26:11>: UDP RTP Port 9014. Response received correctly with no translation. Phase 4-15 check passed.
<16:26:11>: UDP RTP Port 9015. Response received correctly with no translation. Phase 4-16 check passed.
<16:26:11>: UDP RTP Port 9016. Response received correctly with no translation. Phase 4-17 check passed.
<16:26:11>: UDP RTP Port 9017. Response received correctly with no translation. Phase 4-18 check passed.
<16:26:11>: UDP RTP Port 9018. Response received correctly with no translation. Phase 4-19 check passed.
<16:26:11>: UDP RTP Port 9019. Response received correctly with no translation. Phase 4-20 check passed.
<16:26:11>: UDP RTP Port 9020. Response received correctly with no translation. Phase 4-21 check passed.
<16:26:11>: UDP RTP Port 9021. Response received correctly with no translation. Phase 4-22 check passed.
<16:26:11>: UDP RTP Port 9022. Response received correctly with no translation. Phase 4-23 check passed.
<16:26:11>: UDP RTP Port 9023. Response received correctly with no translation. Phase 4-24 check passed.
<16:26:11>: UDP RTP Port 9024. Response received correctly with no translation. Phase 4-25 check passed.
<16:26:12>: UDP RTP Port 9025. Response received correctly with no translation. Phase 4-26 check passed.
<16:26:12>: UDP RTP Port 9026. Response received correctly with no translation. Phase 4-27 check passed.
<16:26:12>: UDP RTP Port 9027. Response received correctly with no translation. Phase 4-28 check passed.
<16:26:12>: UDP RTP Port 9028. Response received correctly with no translation. Phase 4-29 check passed.
<16:26:12>: UDP RTP Port 9029. Response received correctly with no translation. Phase 4-30 check passed.
<16:26:12>: UDP RTP Port 9030. Response received correctly with no translation. Phase 4-31 check passed.
<16:26:12>: UDP RTP Port 9031. Response received correctly with no translation. Phase 4-32 check passed.
<16:26:12>: UDP RTP Port 9032. Response received correctly with no translation. Phase 4-33 check passed.
<16:26:12>: UDP RTP Port 9033. Response received correctly with no translation. Phase 4-34 check passed.
<16:26:12>: UDP RTP Port 9034. Response received correctly with no translation. Phase 4-35 check passed.
<16:26:12>: UDP RTP Port 9035. Response received correctly with no translation. Phase 4-36 check passed.
<16:26:12>: UDP RTP Port 9036. Response received correctly with no translation. Phase 4-37 check passed.
<16:26:12>: UDP RTP Port 9037. Response received correctly with no translation. Phase 4-38 check passed.
<16:26:12>: UDP RTP Port 9038. Response received correctly with no translation. Phase 4-39 check passed.
<16:26:12>: UDP RTP Port 9039. Response received correctly with no translation. Phase 4-40 check passed.
<16:26:12>: UDP RTP Port 9040. Response received correctly with no translation. Phase 4-41 check passed.
<16:26:12>: UDP RTP Port 9041. Response received correctly with no translation. Phase 4-42 check passed.
<16:26:12>: UDP RTP Port 9042. Response received correctly with no translation. Phase 4-43 check passed.
<16:26:12>: UDP RTP Port 9043. Response received correctly with no translation. Phase 4-44 check passed.
<16:26:12>: UDP RTP Port 9044. Response received correctly with no translation. Phase 4-45 check passed.
<16:26:12>: UDP RTP Port 9045. Response received correctly with no translation. Phase 4-46 check passed.
<16:26:12>: UDP RTP Port 9046. Response received correctly with no translation. Phase 4-47 check passed.
<16:26:12>: UDP RTP Port 9047. Response received correctly with no translation. Phase 4-48 check passed.
<16:26:12>: UDP RTP Port 9048. Response received correctly with no translation. Phase 4-49 check passed.
<16:26:12>: UDP RTP Port 9049. Response received correctly with no translation. Phase 4-50 check passed.


Application exit code is 0

2. Will try that and post.

3. Successful at calling other soft-phones on my LAN.

4. My router config was attached to the previous post, but basically - I am quite versed at working on that. In any case, since the FW Checker is passing with flying colors - I think I have it right:

******************************************************************************************

!
interface FastEthernet4
no ip address
duplex auto
speed auto
pppoe enable group global
pppoe-client dial-pool-number 1
!
interface Vlan1
description LAN
ip address 192.168.4.1 255.255.255.0 secondary
ip address 192.168.5.3 255.255.255.0
ip access-group 100 in
no ip redirects
no ip unreachables
no ip proxy-arp
ip nbar protocol-discovery
ip flow ingress
ip nat inside
ip virtual-reassembly
standby version 2
standby 1 ip 192.168.5.1
standby 1 priority 110
standby 1 preempt
standby 1 authentication md5 key-string 7 1111111111111111111
standby 1 name STANDBY
!
interface Dialer1
mtu 1492
bandwidth 500
ip address negotiated
no ip redirects
no ip unreachables
no ip proxy-arp
ip nbar protocol-discovery
ip flow ingress
ip nat outside
ip virtual-reassembly
encapsulation ppp
ip tcp adjust-mss 1430
dialer pool 1
dialer idle-timeout 0
dialer persistent
ppp chap hostname [email protected]
ppp chap password 7 ZZZZZZZZZ
!
no ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Dialer1 name DefaultRoute
ip route 0.0.0.0 0.0.0.0 192.168.5.2 200
ip route 10.0.0.0 255.0.0.0 Null0 name RFC_1918
ip route 172.16.0.0 255.240.0.0 Null0 name RFC_1918
ip route 192.168.0.0 255.255.0.0 192.168.5.2 name XXXXXXX
!
!
no ip http server
no ip http secure-server
ip nat inside source list 1 interface Dialer1 overload
ip nat inside source static tcp 192.168.5.5 5060 XX.XX.XX.XX 5060 extendable
ip nat inside source static udp 192.168.5.5 5060 XX.XX.XX.XX 5060 extendable
ip nat inside source static udp 192.168.5.5 9000 XX.XX.XX.XX 9000 extendable
ip nat inside source static udp 192.168.5.5 9001 XX.XX.XX.XX 9001 extendable
ip nat inside source static udp 192.168.5.5 9002 XX.XX.XX.XX 9002 extendable
ip nat inside source static udp 192.168.5.5 9003 XX.XX.XX.XX 9003 extendable
ip nat inside source static udp 192.168.5.5 9004 XX.XX.XX.XX 9004 extendable
ip nat inside source static udp 192.168.5.5 9005 XX.XX.XX.XX 9005 extendable
ip nat inside source static udp 192.168.5.5 9006 XX.XX.XX.XX 9006 extendable
ip nat inside source static udp 192.168.5.5 9007 XX.XX.XX.XX 9007 extendable
ip nat inside source static udp 192.168.5.5 9008 XX.XX.XX.XX 9008 extendable
ip nat inside source static udp 192.168.5.5 9009 XX.XX.XX.XX 9009 extendable
ip nat inside source static udp 192.168.5.5 9010 XX.XX.XX.XX 9010 extendable
ip nat inside source static udp 192.168.5.5 9011 XX.XX.XX.XX 9011 extendable
ip nat inside source static udp 192.168.5.5 9012 XX.XX.XX.XX 9012 extendable
ip nat inside source static udp 192.168.5.5 9013 XX.XX.XX.XX 9013 extendable
ip nat inside source static udp 192.168.5.5 9014 XX.XX.XX.XX 9014 extendable
ip nat inside source static udp 192.168.5.5 9015 XX.XX.XX.XX 9015 extendable
!
/////////////////////////////////////////////////////////////////////////
access-list 1 permit 192.168.5.0 0.0.0.255
access-list 1 permit 192.168.4.0 0.0.0.255
access-list 100 permit ip 192.168.4.0 0.0.0.255 host 192.168.5.20
access-list 100 permit ip 192.168.5.0 0.0.0.255 any
access-list 100 deny ip 192.168.4.0 0.0.0.255 192.168.5.0 0.0.0.255
access-list 100 permit ip 192.168.4.0 0.0.0.255 any
access-list 100 permit tcp any host 192.168.5.5 eq 5060
access-list 100 permit udp any host 192.168.5.5 eq 5060
access-list 100 permit udp any host 192.168.5.5 range 9000 9049
*********************************************************************************

5. Disabling the SIP ALG is one short command: #no ip nat service sip udp port 5060
I tried that, and then enabled it back.

6. Will set-up the wireshark and see/post results.

As mentioned already, I really appreciate your help!

Luc

 

[eagle2]

Hi Luc,

hope my comments could help you.
Sorry, I missed the router configuration posted earlier.

However, everything seems normal -- the only question I have is whether only ports 9000 - 9015 are NATed or the the whole range 9000 - 9049 (default range in 3CX, see in 'Settings | Advanced | Custom parameters' the values for first and last extension ports). This could be a problem, if ranges are different (nevertheless this should be related to remote phones only).

The other thing I noticed is that you are using PPPoE dial-up (or similar) service. Could your public address change frequently and this to be a problem with the provider, or not having path through the second gateway (192.168.5.2)? Can you ping and traceroute the IP address of the provider from the router and from the PC running the 3CX service ?

Check the other points and we will discuss it further.

Kind regards

 

[lploscar]

Hey Orlin,

Of course your comments help, and I thank you again for the effort!
I went only as far as 9015, as that should be enough for now... Public IP is PPPoE... you are correct! But, it has a "reserved" feature on it, and it did not change in 2+ years
The second Default Route is just for fail-over purposes, and the Provider is being reached just fine by the 3CX System (as the trunk is registering OK, and stays like that).

I got a hold of the Provider's tech support group, and should be able to troubleshoot with them today...
Will return and post results.

Thanks,

Luc

 

[lploscar]

Hey all...

OK... so, Eureka!
It turns out that everything I had was configured properly, but... the free version of the 3CX softphone does not have the G.729 codec. And, the SIP trunk provider is disabling all of the other audio codecs by default (bandwidth usage concerns in SA).
So, as soon as he enabled the rest of the codecs on my trunk (PCMU, PCMA, GSM...) all was fine and dandy!

Thank you for your help and assistance Orlin!

Luc

 

[eagle2]

Hi Luc,

glad to read this

Orlin.