Registration and media issues with overlapping subnets between sites

[sysadminmz]

Similar to a regular trunk, is it possible to manually set the SIP contact and SDP connection fields for a gateway trunk?

In fact, was able to set the SIP contact in the outbound parameters but can’t find where and how to update the SDP connection field for a gateway trunk, ie: Patton SN4171/1E30VHP.

The goal is to register the gateway in site B to 3CX in site A. Both sites are inter-connected over VPN and as the subnets overlap, the traffic is NATed.

Site A: 3CX IP: 10.0.1.1 NATed as 10.10.10.1
Site B: GW IP: 10.0.1.5 NATed as 10.20.20.5
The gateway is added to 3CX as 10.20.20.5 and the 3CX is set in the gateway as 10.10.10.1.

While the registration and SIP signalling works, there is no audio as 3CX sends the local non-NATed IP 10.0.1.1 in the SDP connection field in the SIP INVITE message. As a result, the remote gateway s unable to reach to the 3CX.
How to make it so the IP 10.10.10.1 is shown in the SDP connection field in the SIP INVITE message coming from 3CX?

In an attempt to “make it work”, tried adding the gateway as a Generic SIP trunk, and when compared with the SIP REGISTER messages between the gateway and SIP trunk, see the following message:

26/03/2023 22:50:03 - Got REGISTER for foreign registrar: registrar host <sip: @10.10.10.1:5060/UDP> is not mine!
26/03/2023 22:50:03 - Misdirected REGISTER: RegErr Recv Req REGISTER from 10.20.20.5:5063 tid=33b7eb168882cf5e3 Call-ID=a211af332a0c5a02:
REGISTER sip:10.10.10.1:5060 SIP/2.0
Via: SIP/2.0/UDP 10.20.20.5:5063;branch=z9hG4bK33b7eb168882cf5e3
Max-Forwards: 70
Contact: <sip:[email protected]:5063;transport=udp>
To: <sip:[email protected]:5060>
From: <sip:[email protected]:5060>;tag=616c934800
Call-ID: a211af332a0c5a02
CSeq: 271073982 REGISTER
Expires: 60
User-Agent: Patton SN4171/1E30VHP 00A0BA116CBC 3.20.1-21101 1.6 M5T SIP Stack/4.2.28.153
Content-Length: 0
26/03/2023 22:50:03 - Source is identified as trunk Lc:10002(@Generic SIP Trunk[<sip:[email protected]:5060/UDP>])
26/03/2023 22:50:03 - Unexpected registration from Provider/SlaveBridge: Provider
26/03/2023 22:50:03 - [CM102001]: Authentication failed for AuthFail Recv Req REGISTER from 10.20.20.5:5063 tid=8499f93dfd468de39 Call-ID=a211af332a0c5a02:
REGISTER sip:10.10.10.1:5060 SIP/2.0
Via: SIP/2.0/UDP 10.20.20.5:5063;branch=z9hG4bK8499f93dfd468de39
Max-Forwards: 70
Contact: <sip:[email protected]:5063;transport=udp>
To: <sip:[email protected]:5060>
From: <sip:[email protected]:5060>;tag=616c934800
Call-ID: a211af332a0c5a02
CSeq: 271073983 REGISTER
Expires: 60
Proxy-Authorization: Digest username="10002",realm="3CXPhoneSystem",nonce="414d535c1a3140fb05:4640f3489a873cd55e9821c875ca82cd",uri="sip:10.10.10.1:5060",response="ee685fda4bc04d72bb989c92c643fa84",algorithm=MD5
User-Agent: Patton SN4171/1E30VHP 00A0BA116CBC 3.20.1-21101 1.6 M5T SIP Stack/4.2.28.153
Content-Length: 0

; Reason: Credentials don't match, check that authorization-ID and password match the ones in extension settings

What does it mean “Unexpected registration from Provider/SlaveBridge: Provider”?
How to modify the SDP connection field in the SIP INVITE message for a gateway trunk?
What am I doing wrong?
What can I do to make it work?
How would you do it differently?

Thanks in advance for your support.

 

[JohnS_3CX]

Hi,

How to modify the SDP connection field in the SIP INVITE message for a gateway trunk?

You cannot.

What am I doing wrong?

You are using an entirely unsupported way of connecting a FXO gateway. This will never work because you are using NAT to modify the IPs without the PBX or the Gateway being aware.

What can I do to make it work?

Have the gateway on the same LAN as 3CX with absolutely zero NAT between them.

How would you do it differently?

I would use a SIP trunk instead of a gateway.

If that is not possible, I would install the PBX at the same site as the gateway to avoid this issue entirely.
And for remaining IP phones, a 3CX SBC can be used to connect the two sites instead of a VPN (if you don't have IP phones there ignore this).

It's entirely backwards right now and while you can try different tricks to make it work, the effort will not pay off in the long term stability of the system.

 

[sysadminmz]

This will never work because you are using NAT to modify the IPs without the PBX or the Gateway being aware.

It works with a trunk though, as I am able to establish a trunk, modify the header and have 2-way media. Is there something specific to gateway trunks preventing this?

Have the gateway on the same LAN as 3CX with absolutely zero NAT between them.

It would be tricky because there are overlapping subnets between the sites and the gateway is also registered to a local 3CX in its site.

I would use a SIP trunk instead of a gateway.

When I add the gateway as SIP trunk, I see this in the logs:
26/03/2023 22:50:03 - Unexpected registration from Provider/SlaveBridge: Provider

The whole idea is to leverage existing connectivity between site to be able to use the gateway which is in the remote site.

 

[JohnS_3CX]

It would be tricky because there are overlapping subnets between the sites and the gateway is also registered to a local 3CX in its site.

Hmm it looks like you have extremely over-complicated your setup and I'm afraid that you are about to make it even worse if you do it this way

However, since you've now told us that you have two PBX machines we have a solution you might like, which does not need any of the above over-complicated setup, or VPN or SBC and which might actually get you the desired effect: https://www.3cx.com/docs/manual/connecting-pbx-bridges/

Basically you can bridge two 3CX systems together, in a supported way and they can share each others trunks. The remote PBX (which has no FXO gateway) can send/receive calls via the other PBX that has the gateway already configured. The extensions of side A can even call the extensions of side B and even share presence with each other.

Take a look at the link I shared above, and if you have further questions follow this second link too:
https://www.3cx.com/3cxacademy/videos/advanced/3cx-bridge-configuration/

PS: You will need to have a Pro or Enterprise license to use this feature, but I think it's a solution that will work for your needs.

 

[sysadminmz]

Thanks for your reply, I will have a look at it.

With bridges, it is possible to modify the SIP headers including the SDP? This is because while the need to register the gateway in the remote site is removed, both sites still share the same subnet.

 

[JohnS_3CX]

You won't need to modify anything, that's the whole point of using the bridges.
And I would not be mentioning bridges if it necessitated modifying SIP/SDP headers

You will not be using the VPN at all so there is nothing here to modify.
When setting up your bridges the PBXs will use each other's FQDN to connect their bridge over the internet.


The 3CX Tunnel connection will pass the SIP and SDP via an encrypted TLS connection so the NAT won't even be part of the problem. We already have this solution available for customers that need to share Trunks across different PBXs.

But, you have to make sure that both machines have correct internet access.
Click here and run the firewall checker on both machines and ensure that ALL tests pass.

If they don't pass, you can read here which ports to open on your firewall on each side, for each individual PBX:
https://www.3cx.com/docs/ports/

 

[sysadminmz]

Brilliant, thanks for your insights.

 

[sysadminmz]

You will not be using the VPN at all so there is nothing here to modify.

Out of curiosity: using bridges through a dedicated point-to-point link would not work as we would still have the NAT issue and it is not supported, right ?