Post Update to Version 16 403 Error on outbound calls.

[EtschelNetkey]

A customer using 3CX was upgraded according to the instructions (Backup tool - deinstall - reinstall version 16 using the backup during installation).

We now have a problem that nobody can make any outbound calls. it shows the error: "Deutsche Telekom SIP-Trunk (NGN) has failed. "IP adress" replied: 403 Forbidden".
A ticked opened with Tekom Germany and a question why we receive a 403 was answered with "The Systems TCP source port was changed and got denied".

Going through all instructions and recomended settings from 3cx regarding Telekom SIP konfigurations everything is configured to specs. Sip Trunk Konfiguration was deleted and added again. Sip Shows green status. After a day going through all settings and trying multple fixes we had to roll back to a backup of Version 15.5 where everything works without any Problems with the exact same configuration.

Anyone else had any issues like that?

 

[JohnS_3CX]

Hi there,

Can you share some additional information?

1. Did you run the firewall checker while on V16?
2. Is SIP-ALG active on your firewall/router?
3. Did you change the machine/VM or is the same as before with same network config?
4. Is there a single NIC on your PBX?

From Deutsche Telekom's response it sounds initially as a port remapping case

 

[EtschelNetkey]

1. Port Firewall check was run and passed.

2. No changes where made on the Firewall. Settings worked/work fine on V15.5. See screenshot of firewall rules on the WatchGuard Firewall (blacked out points to vm of 3CX System).
No SIP ALG is active on the Firewall.



3. It is the same VM, same Windows patches and settings. It is a dedicated Server, nothing has changed other than simply following the 3CX upgrade instructions to Version 16.

4. Only a single NIC on the VM that runs 3CX. It is a dedicated VM that runs nothing else but 3CX.

 

[JohnS_3CX]

Ok under the current circumstances then it's worth investigating further via 3CX Support because on our test system we can make calls successfully using your provider on V16SP2.

If you like you can set up a test VM system and at a time when convenient to you, register your trunk on it to perform some tests when your V15.5 is not in use (disable the trunk there first temporarily).

Support will need a capture of calls to see exactly what the PBX transmits to DT so we can investigate what happens in your specific case.

 

[EtschelNetkey]

I have saved both the pre-update VM and the system post update. It is fairly easy to temorarly switch to either VM. I will check with our customer when we can run some tests.

Whom should I contact on the 3CX side?

 

[JohnS_3CX]

3CX Support directly by opening a ticket for a full investigation.

Here's a brief of the support procedures: https://www.3cx.com/ordering/