Registering Cisco SPA501g over site to site VPN

[CXteleco]

Hello everyone,
I am testing my new 3CX pbx, by now most tests are working fine. Firewall test ok, local ip phones (Cisco spa501g) ok... But today I am trying to register a remote ip phone of a remote site (over vpn), and I can`t do it. I didn`t try Provisioning yet, because I found how to register manually with only some parameters on the phone web interface, like I did it in some local phones.

OVER SITE TO SITE VPN:
I can ping correctly from remote LAN to the private pbx ip (over my vpn), but the phone says ==> Registration State: FailedNot Reachable
And I can`t see anything on the Activity log of my 3cx (seems true that it is not reaching the pbx)
Is there any special config to do about remote extensions over vpn? I remember that I had to define remote networks on my old Free PBX to have audio, but in this case, the remote extension can`t even register.
Bye the way, same remote ip phone registers ok on my old FreePBX on same vpn.
Thanks for your help.

 

[CXteleco]

I could register the extension doing "Provisioning" finally. I am trying know to configure other line of same SPA501G, registerig to the actual pbx (old one). I would like to know why I can register to the new 3cx pbx using Provisioning, and I can`t do it when I try manually on the phone's GUI. Any idea? Thanks.

 

[rgruber]

I would use an SBC at the remote site, fairly easy to set up.

https://www.3cx.com/docs/3cx-tunnel... you,Once your SBC is installed, you... More

You need your certificate installed on your server hosting the SBC before installing the software.


Without an SBC, you can also try:

https://www.3cx.com/sip-phones/dhcp-option-66/

Manually add the phone to the required extension within the 3CX console using the mac address of the phone.
Reboot the phone, and the phone should provision itself.

If you don't have valid server certificate, there may be an option in the phone to ignore invalid certificates, depending if you are using a host name or IP.

 

[cobaltit]

So the SPA5xx phones are not supported by 3CX for use with the SBC so I wouldn't go that route. If you have a properly configured VPN connection the local should be fine.I would confirm you have logging set to verbose and I would start a capture in 3CX and then try to register the phone. The settings should be exactly the same as what you are using on the phones local to 3CX. If it doesn't work and you don't see attempts in 3CX/wireshark, then that's a networking issue and not a 3CX issue you need to troubleshoot.

 

[CXteleco]

Thnks cobaltit, finally I can register ok over my vpns. I dind`t understan why I couldn't at the first attempt, and I could before provisioning. Regarding differences post-Provisioning one phone, I think it was about the ports I was using on that phone. 3cx only register with 5060 (default port if not changed), and I was using 5060 for other extensions registered to other pbx, on same phone...