Problem adding a new extension

[Bert1]

OK, I'm new to 3CX so I am most likely doing something very simple incorrectly but I can't get this thing to work at all. Every time I add a user, the Extensions page shows the user with a big red circle on the left which, I assume, means that the account is not properly configured. If I hover my cursor over the red "!" beside the account name, it tells me that the password must be at least 10 characters long with one capital, one lower case and one digit in it. Yet, when creating the account, the system provides a password (where it gets it from, I don't know) but, while it will allow me to change the password, the new password never sticks. Every time I go into the extension details, it has the same, incorrect, password.

So, am I correct in assuming that the red circle means that the extension is not operative? If yes, what do I need to do to get it operational?

On another note, is there anything special I have to do to get a Polycom VVX401 to play nice with a 3CX or is the problem I am having with it related to the extension issue mentioned above?

Thanks

Bert

 

[Bert1]

Also, I don't think Windows 7 is supported for V16, so make sure to be using Windows 8/10 or better yet, switch to the debian version.

For the outbound call and forbidden message, sounds like an outbound rule missing OR your SIP Trunk Provider is rejecting it. Check the logs for more info.

Yes, I suspect that I am looking at a firewall configuration issue but, unfortunately, I am running a Fortinet firewall which means that I have limited monitoring facilities. I will have to go through the 3CX docs to make sure that the firewall is properly configured.

Bert

 

[Bert1]

OK, firewall checker is reporting all kinds of issues. I have verified (I think) that I have everything configured according to 3CX docs but I am still getting:

• testing 3CX SIP Server... failed (How to resolve?)
  • stopping service... done
  • detecting SIP ALG... detected (sent 5e79505d ≠ 5e552574) (How to resolve?)
  • testing port 5060... Mapping does not match 5060. Mapping is 65476. (How to resolve?)
  • starting service... done
• testing 3CX Tunneling Proxy... failed (How to resolve?)
  • stopping service... done
  • testing port 5090... Mapping does not match 5090. Mapping is 65506. (How to resolve?)
  • starting service... done
• testing 3CX Media Server... failed (How to resolve?)
  • stopping service... done
  • testing ports [9000..9398]... failed (How to resolve?)
    • testing port 9000... full cone test failed (How to resolve?)
    • testing port 9002... full cone test failed (How to resolve?)
    • testing port 9004... full cone test failed (How to resolve?)
    • testing port 9006... full cone test failed (How to resolve?)
    • testing port 9008... full cone test failed (How to resolve?)
    • testing port 9010... full cone test failed (How to resolve?)
    • testing port 9012... full cone test failed (How to resolve?)

And so on to the end of the ports. All of them are open (incoming) on the firewall so I don't understand the terminology being used here. What is this trying to tell me?

Bert

 

[AWS2P]

All this means your firewall has SIP alg enabled, and ports are not open as required in 3CX documentation.
In that case it's impossible to use a 3CX pbx properly, you need to fix this in your firewall or change it if nothing can be done in settings.

 

[Bert1]

All this means your firewall has SIP alg enabled, and ports are not open as required in 3CX documentation.
In that case it's impossible to use a 3CX pbx properly, you need to fix this in your firewall or change it if nothing can be done in settings.

Yes, I know but I have followed all of the 3CX recommendations and, as far as I can tell, my firewall is compliant. So, the questions are, what is this telling me? What is a cone? What is this mapping? How do I determine exactly what 3CX expects but is not being provided?

Bert

 

[SweetAction]

Follow these steps to disable SIP ALG. After done, see what the firewall checker shows:
https://www.3cx.com/community/threads/fortigate-sip-alg-disable-steps-5-2-firmware-and-above.47694/

 

[Bert1]

Follow these steps to disable SIP ALG. After done, see what the firewall checker shows:
https://www.3cx.com/community/threads/fortigate-sip-alg-disable-steps-5-2-firmware-and-above.47694/

Already done. The only change is that the entry "detecting SIP ALG... detected (sent 5e79505d ≠ 5e552574) (How to resolve?)" is gone now. All of the other errors are still there. :-(

Bert

 

[SweetAction]

You are still getting stuff like:
Mapping does not match 5090. Mapping is 65506

 

[Bert1]

You are still getting stuff like:
Mapping does not match 5090. Mapping is 65506

Yes. Every error except the one I mentioned above is still there.

Bert

 

[AWS2P]

did you reboot firewall ?

 

[Bert1]

did you reboot firewall ?

Yes.

Bert

 

[SweetAction]

And you followed this guide in full?
https://www.3cx.com/docs/fortigate-firewall-configuration/

 

[JohnS_3CX]

Are you using internet explorer?

 

[Bert1]

And you followed this guide in full?
https://www.3cx.com/docs/fortigate-firewall-configuration/

Yes except that the commands "set default-voip-alg-mode kernel-helper based" and "set status enable/disable" failed.

 

[Bert1]

Are you using internet explorer?

I had been, yes, but I noticed that on one of the 3CX documents I read that IE is not one of the supported browsers. I changed to Chrome and the problem I had been having with the passwords disappeared.

Bert

 

[JohnS_3CX]

To recap on whole thread:

Red dot = Extension currently not registered
Exclamation mark = authentication credentials not deemed secure enough (hovering shows which ones)
Windows hosts = does not update across major versions, you just get service packs
Firewall checker failure = you don't have full cone NAT and/or ALG is active on your firewall

I would highly recommend to read the sticky before posting, and make separate posts for separate issues to have better chances of getting the correct views and answers
https://www.3cx.com/community/threads/information-to-provide-when-requesting-help.67558/


Also If you are new to 3CX, I would strongly urge you to make use of our 3CX Academy. I could not recommend it enough, it is a very useful tool for learning all the fundamentals fast and will save you a lot of trouble in the future. Without this knowledge you may find that your are investigating what appears to be an issue, only to find out that some simple basic step was left behind earlier that would make your life much easier https://www.3cx.com/3cxacademy/

 

[Bert1]

Well, all errors except "testing port 5060... Mapping does not match 5060. Mapping is 65476" and "testing port 5090... Mapping does not match 5090. Mapping is 65506" are gone. Outgoing calls work but incoming still fails. Plus, adding the VVX is not successful.

Bert

 

[SweetAction]

You will have to get your firewall person to resolve the nat issue. You will have many issues if 5060 - the sip port - isn't mapping through correctly. 5090 being the tunnel port - also going to be an issue with remote phones.

 

[Bert1]

You will have to get your firewall person to resolve the nat issue. You will have many issues if 5060 - the sip port - isn't mapping through correctly. 5090 being the tunnel port - also going to be an issue with remote phones.

To make things more interesting, it is a new firewall of a type I have never used before :-(

However, even though those two ports are still failing, I am getting calls in and out. It is odd that calls will go out on one sip trunk and in on a second one but I can't get two way traffic on either trunk yet. Still working on it but I am making progress

Bert

 

[AWS2P]

For sure , searching time is never lost time, you learn more about product. Guilty one is found as the firewall, so now you need help about this new model. Hope you'll fix this very soon.

 

[Bert1]

For sure , searching time is never lost time, you learn more about product. Guilty one is found as the firewall, so now you need help about this new model. Hope you'll fix this very soon.

Yup. One should never deploy two interdependent products at the same time :-o

I do have everything working now except the 3CX app on my iPhone. It is configured and rings when incoming calls are made but I have no media. I assume that there are some additional ports that need to be opened on the firewall but I haven't been able to find them yet. More searching

Bert