Remote office user cannot make successful calls through site to site vpn with FXO line

[Kane Wong]

Hi;

I have Office A and Office B, they are connected by using site to site VPN. My 3CX server and the analog line are both deployed at Office A, the Office A is using Patton FXO device for analog connectivity. At Office A, I have no problem to dial out and receiving call through the analog connection. However; at Office B, it cannot.

First of all, both Office A and B can make internal call (extension to extension), no problem. When I make an outbound call from an IP phone at Office B to my own cellular phone, my cellular phone can ring but cannot talk.

1. During dialing, there is no connection tone during the dialing but my cellular phone ring.
2. When I answer the call from my cellular phone and start talking, both handset no sound.

What can I do to diagnose the site to site connection to make outbound call?

 

[cobaltit]

Sounds like you have NAT or some other firewall mangling happening on your S2S traffic. You need to have a routed VPN (no NAT). Otherwise you need to install a SBC.

 

[eddv123]

We deploy VPN connected/hosted 3CX in 90% of our deployments and can say with some confidence that this is a networking issue.

With VPN connections is is likely that your firewalls will have a VPN/IPSec interfaces of which traffic will be blocked by default - we normally open this up unless in circumstances where security is sensitive, however it would be a good first step to pin-point the problem.

From your description it sounds like SIP is configured correctly however but no audio. I would also check that on both firewalls SIP ALG/Helper/transformations are disabled (different names based on the vendor of the firewall).

 

[Kane Wong]

Thank you, let me look into it from here.

Also, I tested by PRI connection, it works OK if I make an outbound call from Office B. My deployment has two phone PSTN connectivity, PRI and Analog. The PRI is always set to Route #1 as main setup, and the Analog (FXO) is set to Route #2 as backup.

Because this is my new deployment, I am testing all features and functions and when I tested PRI this morning, the outbound call is fine from both offices, only the FXO is not working from Office B.

 

[cobaltit]

So I know at one point Patton 3CX templates would deploy without a gateway. I'd make sure your FXO device has a gateway and that it's correct.

 

[eddv123]

In the gateway part of the configuration on 3CX this is called "Default IP Route " and would normally be the router/firewall/gateway (layer 3 device) on your network (don't get data gateway confused with media/voice).

This can however be added into the Patton with the commands:

Smartware:

https://www.3cx.com/voip-gateways/patton-network-configuration/

Trinity(via CLI)

routing-table DEFAULT
route 0.0.0.0/0 gateway 192.168.1.1

192.168.1.1 is just an example, this needs to be swapped for your actual IP address.

 

[Kane Wong]

Thank you!
I checked the routing configuration in my Patton FXO unit, it is using Smartware and here is the result.

Route Table of IP context 'router':
Validity state (V): * valid, (*) duplicate, (-) down
Flags: U up, H host, G Gateway, L local, D default
-------------------------------------------------------------------------------
V Destination Traffic Cl. Interface (Next Hop) Protocol Met. Flags
-------------------------------------------------------------------------------
* 127.0.0.1/32 loopback Local 0 ULH
* 192.168.120.113/32 loopback Local 0 ULH
* 192.168.120.0/24 IF_IP_LAN Local 1 UL
* 127.0.0.0/8 loopback Local 1 UL
-------------------------------------------------------------------------------

Where the ip 192.168.120.113 is the FXO device and this LAN is sitting at Office A.

My Office B is using another subnet, e.g. 192.168.220.0/24

In this scenario, I need to add a static route for routing back the voice traffic for my Office B.
I should have a route for destination 192.168.220.0/24 through the site-to-site gateway (firewall) subnet, correct?

 

[eddv123]

As per the guide, used when:

Patton PSTN Gateway not in the same subnet as 3CX PBX

Patton PSTN Gateway not in the same subnet as IP-Phones
Result: Calls ring and (dis-) connect but audio is not send the the IP phone → One Way Audio

From your description your gateway sounds like it is local to your PBX, but with remote IP phones on a different site connected via IPSec VPN tunnel.

 

[Kane Wong]

As per the guide, used when:

Patton PSTN Gateway not in the same subnet as 3CX PBX

Patton PSTN Gateway not in the same subnet as IP-Phones
Result: Calls ring and (dis-) connect but audio is not send the the IP phone → One Way Audio

From your description your gateway sounds like it is local to your PBX, but with remote IP phones on a different site connected via IPSec VPN tunnel.

Yes, the IP phone at Office B is not at the same subnet as this Patton FXO. Any thing I can do?

 

[eddv123]

Since you can make internal calls between offices across the VPN tunnel I think it less likely that the VPN interfaces could be blocking as mentioned earlier (still worth checking however).

Looking at the route guide I think you maybe experiencing the issue mentioned:
"Result: Calls ring and (dis-) connect but audio is not send the the IP phone → One Way Audio"

The problem here is that your default route set on the Patton will be for office A, so I would try enabling PBX delivers audio on the extension on the remote office first and if that doesnt work run a PCAP capture of the call from 3CX (with PBX delivers audio on it should capture both legs) and see what is going on with the audio.

 

[cobaltit]

PBX delivers audio would be work around but like many issues on here, your issue boils down to basic networking and is not a 3CX issue. As I said in my earlier post, the issue is a the lack of a default gateway on the FXO device. You don't need to add a specific route to your Office B subnet because presumably you have a single gateway on the network and that gateway is where your site to site VPN terminates. So if you add the same gateway to the Patton that your 3CX PBX is using it will send the audio traffic for Office B to your gateway device. That device will see the Office B destination and know to route it over the VPN. Again, just basic networking that devices need to know how to get from point A to point B. The only reason to add a specific route to Office B would be if the default gateway for the network and the VPN gateway were different devices. Or I suppose if you didn't want to give internet access to the device but did want it to reach Office B then adding the specific route would also work.

 

[Kane Wong]

Problem solved after adding the gateway information back to system. The default 3CX generated template do not include the gateway IP, therefore; no next hop for another subnets.

context ip
route 0.0.0.0 0.0.0.0 192.168.1.1

 

[Ricardos]

Thank you. I had same problems when I used purevpn.

 

[Ricardos]

Thank you. I had same problems when I used purevpn. By the way, I found an article about Best VPN for Chromebook – Chromebook VPNs Review | Webguidevpn

Very useful. Thank you.