Toggle sidebar Toggle sidebar

phone not connecting when on another (vpn connected) subnet

Status
Not open for further replies.

GVB

Customer
Joined
Sep 8, 2017
Messages
67
Reaction score
4
Hello,

I have prepared some phones for another site.

While these phones work fine locally the phone I took with me to the other site simply doesn't connect.

The current situation is like this.

3CX server 192.168.0.52
Fanvil X3G phone 192.168.10.118

There's a site to site vpn between the 2 sites set up with EdgeMax routers

I can connect from .0 to the phone webUI at .10.118
I can connect from a pc next to the phone to the 3CX web console & server (rdp) aswell

so routing is ok.

yet the phone is still not connecting and giving either a "TIME OUT" or "Failed With 404" error.

do I need to allow that .10 subnet in 3CX or something?
 
Firstly here are the supported network setups with 3CX - it covers VPN here so have a read:
https://www.3cx.com/blog/docs/network-configurations-supported-3cx-phone-system/

By connecting, are you referring to registering to 3CX or actual calls ? if I setup phones across a VPN I would normally do this with DHCP option 66 provisioning: https://www.3cx.com/sip-phones/dhcp-option-66/ although the provisioning link can be inputted into the phones interface.

In 3CX also check under the phones extension - you may have to change the interface (drop down box) for the extension and re-provision, if I recall from a previous setup this caused me issues here.

You might also want to check this page here: https://www.3cx.com/blog/docs/network-topology/
Particularly if you are covered by the "supported" local subnets with 3CX. These can also be viewed by looking in the PBX under parameters.
 
sorry, with not connecting I meant not registering.

I also don't see anything in the dashboard like an ip block or something.

One annoyance I have with 3CX is that the phones disapear when they are not connecting which is a problem as 3CX changes the phone passwords.

I can have a look at the dhcp option but as written earlier the phone worked so it has the valid server IP and account settings still in its config.

I'll go through all your posted links maybe that brings something up that I missed.

Thanks
 
GVB said:
One annoyance I have with 3CX is that the phones disapear when they are not connecting which is a problem as 3CX changes the phone passwords.
Click to expand...

Do you mean in the "phones" list for pnp ?

The reason I mention this is because a normal IPsec VPN tunnel does not support the multicast traffic required for pnp so will/should not enable phones to appear like this: https://www.3cx.com/docs/plug-and-play-ip-phone/

I do have a thought which I have not been able to test yet which involves using IPsec over GRE tunnel (IPsec providing the security/GRE supporting multicast traffic support) to see whether it will allow the multicast traffic over the VPN for PnP provisioning. Whilst on the subject it would be good to get some feedback as to whether anyone has attempted this. This would be great if successful:

https://www.cisco.com/c/en/us/support/docs/ip/ip-multicast/43584-mcast-over-gre.html
 
Last edited:
Check that 192.168.10.0 / 24 has not been blacklisted.

On the Provisioning tab of the phone within 3CX Management console, what is in the 'Select Interface' - is it the IP address of the server or FQDN of the server. If FQDN make sure that you can resolve the fqdn on the 192.168.10.0 / 24 network
 
Last edited:
currently there's only the 192.168.0.52 IP used in the phone config.
 
Saqqara said:
what is in the 'Select Interface' - is it the IP address of the server or FQDN of the server
Click to expand...

I can't access the phone as it is not connected but I always used the internal IP address.
 
You aren't manually setting this up I hope ? you are using the provisioning file provided by 3CX ? either via DHCP option or the provisioning link.

As I said I would try toggling the interfaces however the phone should be able to have the facility to PCAP from its interface, if you can get to it run a PCAP and see what the response to the register is.

If the tunnel is up you should be able to RDP to a local machine or something like that.
 
no :) the phones where provisioned by 3CX before and pushed the config in it which is still there as I can see it via the webUI of the phone.

as I wrote in my initial post I don't have any issues to take over a machine via RDP or access webUI's from any direction.

I installed wireShark on the server and I don't see anything from 192.168.10.118 passing by but this might be masked by masquerade on the edgerouters? A ping from the other site's edgerouter is visible by as reply ip the local edgerouter. the replies arrive at the other site tho.
 
From the 3CX server can you ping the phone IP address ?

Are you blocking any ports down the VPN , i.e. are you allowing all ports between the two networks.

Can you see any traffic in the 3CX activity log from the remote network.
 
yes. I just tried it on the server instead of my own computer.

I can ping and get replies.
I can also access the webUI of that phone.
 
OK so if you can get to the web GUI of the phone (and it supports PCAP - I am not familiar with Fanvil but know both Yealink and snom do) run the PCAP and make a re-registration attempt, and see if 3CX responds to it.
 
do you mean a packet capture on the phone itself? I doubt it.

But I just spotted an MCAST tab.

Not sure what I should fill in there tho.
 
Yes, here's what you do on a Yealink: http://support.yealink.com/faq/faqInfo?id=320

If your an IP phone does not support such a useful troubleshooting feature I would suggest switching brands - I am yet to find a phone which doesn't so this would be a first for me.
 
ok, thanks for the hint. I found the pcap on the phone.

There I can see 2 requests

123 32.710000 192.168.0.52 192.168.10.118 SIP 568 Status: 407 Proxy Authentication Required |

125 32.780000 192.168.0.52 192.168.10.118 SIP 429 Status: 404 User unknown. |
 
If you don't mind PM me the PCAP and I will take a look.
 
Done...

Not sure why it would give that error tho.

I checked the extention user & password and it's the same on both ends.
 
I will take a look at the PCAP shortly, however your response normally should be something like:

404 Not Found – The server has definitive information that the user does not exist at the (User not found). As per https://www.3cx.com/pbx/sip-responses/. A 404 error is normally a client side error.

Can you first try completely resetting the phone and re-provisioning (deleting and re-creating the extension even would be ideal).

The reason I ask this is because I have found other links on the 3CX site (for extensions and trunks) that suggest a complete delete and re-create have solved the issue. For example: https://www.3cx.com/community/threads/error-message-404-user-unknown.47079/
 
I think I know what's going on.

We have 2 3CX pro servers here.

It seems that the NATing from the lan side also redirect to the wrong 3CX server.
This was only supposed to happen from WAN>LAN and not over the VPN.

I can see in the activity log that my phone tries to register on that wrong server
 
  • Like
Reactions: eddv123
Status
Not open for further replies.

Latest Posts

Forum statistics

Threads
112,357
Messages
592,085
Members
165,526
Latest member
K7oR0x
3CX Logo Footer Copyright © Sitemap Privacy
Top Bottom