Random Port "mapping does not match" v16

[SouthwestAV]

I know you've all seen this message before, but I'm gonna ask it anyway. I have 2 installs at separate facilities which are both exhibiting the same new behavior. These 2 locations were installed a month or so ago on 15.5 (Windows), and passed the firewall check. Both are running on a Fortigate 100E. I have followed all the guides and requirements for Fortigate usage.

The locations in question are not quite open for business, and I was asked to bring them up to v16 before the doors open. Now, in both locations, I'm seeing random ports display the "mapping does not match" error when running the firewall checker. It is always 1-5 random ports, and they are always off by 1-2 lines. For example, 9214 will report as 9212, etc. The list changes every time.

NOTHING has changed on the firewalls - I'm the only one with access at the moment. I've verified there are no flooding / DoS policies in place. I've been chasing this a few hours now with no explanation and countless failures.

Soooo... I rolled one of them back to 15.5 while making no changes to networking. Passes fine. Ran it 3 times. To reiterate, a machine that fails the firewall check on v16 passes with flying colors on 15.5 with no changes to any networking configs.

I notice the firewall check is much faster in 16. Is there a way to slow it down? I think that may be part of the issue. Has anyone else seen this behavior? The ports and check process are the same as far as I know. Appreciate any ideas you may have. Knowing it passes on 15.5 and the networking is correct, I'll probably go to 16 and leave them, but seeing that big failure is going to bug me.

Thanks.

 

[YiannisH_3CX]

Hello @SouthwestAV

Can you run a packet capture on the PBX while still on V15.5 running the firewall checker and save it and when you upgrade to V16 run a capture on the same machine while the firewall checker is running and send me a p.m so we can look into the issue?

 

[SouthwestAV]

Hi @YiannisH_3CX

PM Sent. Thanks!

 

[houston]

Just wanted to add that I saw exactly the same behavior. Using Unifi USG-Pro-4 as the firewall and Windows as the OS.

After spending about an hour investigating, I just figured it was a bug, and rolled back to v15 and plan to stay there for the next couple of months and let others be beta testers.

 

[paulow1978]

yep, me too. Just had this issue and spent a day looking into it thinking it was our firewalls.... Hopefully this will get resolved very soon!

 

[paulow1978]

yep, me too. Just had this issue and spent a day looking into it thinking it was our firewalls.... Hopefully this will get resolved very soon!

Hi @YiannisH_3CX

This does seem to be a buig. Is there anything we can do as a work around? should we roll back or is it not a show stopper?

 

[cobaltit]

It's your PBX, is it working? Then not a show stopper. At the end of the day the firewall checker is just that. It's supposed to tell you if your firewall is setup properly but whether it passes or fails it doesn't make any changes to 3CX or the firewall.

 

[Nick W]

We have seen this problem recently and it sometimes goes away on second check.

We primarily use Mikrotik and have seen the issue there and behind Cisco too.

 

[YiannisH_3CX]

Please note that we have identified an issue with the firewall checker in V16 which can falsely fail a few RTP ports in certain scenarios. If you are only failing a few RTP ports with the "mapping does not match"
message then i would recommend ignoring them for now until the issue has been resolved.