Phones on site not fully functional after FW change

[Rob_Craig]

This is the message we got from client

Our office transfers are not working, by not working I mean I pick up a call on the physical handset at front desk and transfer it to another physical handset in the office and they cannot hear me announce the call or I cannot hear them but if I transfer the call it goes through and person can hear incoming call

New firewall running OPNsense, latest FW. Phone system in cloud and phone system support saying that issue is related to SIP ALG but am sure this isn't a feature on OPNsense.
No SBC on site and phone GUI looks to have them provisioning straight to phone system FQDN.
Have created inbound rules on WAN for all ports in question as well as setting Outbound NAT to Hybrid and adding in rules there. All tied down to public IP of phone system.

Any one have any idea why internally they can't hear each other during call announce?

 

[Saqqara]

Guessing phones are setup as stun

if save yourself a load of hassle install a sbc server , if the phones support it

as the 3cx is in the cloud, you do not have to do any firewall rules except the rules portforwarding rules required for stun - above url

 

[Rob_Craig]

Guessing phones are setup as stun

if save yourself a load of hassle install a sbc server , if the phones support it

as the 3cx is in the cloud, you do not have to do any firewall rules except the rules portforwarding rules required for stun - above url

Thanks for the link will look into it.
We are taking over from existing provider but phones and phone system still in contract.
Our usual practice is to install an SBC with our phone systems to make life a lot easier. Do like how it states the recommend setup is with SBC when deploying remote phones.