Remote phones STUN or SBC

[Philip Darnell]

Hi

I have a setup with 20 remote extensions all on one site.

I Have them setup as STUN at the minute with port forwarding setup on the router and sometimes certain phones aren't ringing straight away and having a few issues.

Should STUN work okay for 20 phones on one site?
Or would I be better with an SBC?

 

[sip.bg]

Issues may arise from using SIP ALG in remote site router or NAT not being handled directly -- some routers will not modify the port, so you can't have more than one remote extension using local port 5060.

 

[Philip Darnell]

Thanks for the reply, I've disabled SIP ALG.
As far as I'm aware NAT is being handled correctly, I have setup port forwarding for the local SIP ports and given each phone a different local SIP Port

 

[sip.bg]

As far as I'm aware NAT is being handled correctly, I have setup port forwarding for the local SIP ports and given each phone a different local SIP Port

At remote site you should not forward any ports by default. This could be an issue.

 

[Philip Darnell]

So at the remote site I don't need to open the SIP ports for the phones?

 

[sip.bg]

Yes, exactly.
Nothing.

You can leave each remote phone to use different local SIP port, it is safe.
For STUN server in your remote phones you can use the public IP address of your PBX (if static) at port 5060.

 

[leejor]

Without an SBC, and depending on the make/model router, there can be audio issues (as in lack of), when calling extension to extension at the remote location. Port forwarding should not be necessary, but if the sets are using static IPs, it won't hurt. That doesn't do anything to help the audio ports if there is an issue.

 

[Saqqara]

Better off using a SBC server, which overcomes all the ports, nat issues with this amount of phones.

Check out https://www.3cx.com/community/threads/stun-vs-sbc.47510/

 

[sip.bg]

Better using SBC, if there are issues. If not (normally), STUN is enough. Using SBC may be not always a straightforward job. For 20 extensions you need quite powerful device for SBC.

 

[Saqqara]

Can you not setup a site to site vpn, then you configure the phones are if there are on the 3cx lan

 

[leejor]

Can you not setup a site to site vpn, then you configure the phones are if there are on the 3cx lan

You can, but many have to work with what is there currently. In most cases VPN hardware can be more expensive than an SBC.

 

[sip.bg]

VPN can be very inexpensive with MikroTik routers, the price of a HAP-lite model, enough for remote office, starts from about US $20. A good branch office router will cost about $50 - 60.
I maintain over 50 3CX cloud implementations with MikroTik CCR-1009 router, cost about $500 at 1-2% load of the router and small routers at remote sites using IPsec VPN without any issues. Both L2 and L3 connectivity is possible to remote sites, which makes life easier than using SBCs. This doesn't mean in cases where you don't have control to network equipment you can't use SBCs, nevertheless you may use small routers at remote sites behind other routers and configure phones to use them as a network gateway.

 

[Philip Darnell]

Without an SBC, and depending on the make/model router, there can be audio issues (as in lack of), when calling extension to extension at the remote location. Port forwarding should not be necessary, but if the sets are using static IPs, it won't hurt. That doesn't do anything to help the audio ports if there is an issue.

Doesn't appear to be any audio issues, mainly issues with phones being slow to ring, for example, in a queue with 5 phones ring all, 3 will ring straight away and the other 2 about a second behind.

Better off using a SBC server, which overcomes all the ports, nat issues with this amount of phones.

Check out https://www.3cx.com/community/threads/stun-vs-sbc.47510/

Thanks I will check that out.

Can you not setup a site to site vpn, then you configure the phones are if there are on the 3cx lan

VPN can be very inexpensive with MikroTik routers, the price of a HAP-lite model, enough for remote office, starts from about US $20. A good branch office router will cost about $50 - 60.
I maintain over 50 3CX cloud implementations with MikroTik CCR-1009 router, cost about $500 at 1-2% load of the router and small routers at remote sites using IPsec VPN without any issues. Both L2 and L3 connectivity is possible to remote sites, which makes life easier than using SBCs. This doesn't mean in cases where you don't have control to network equipment you can't use SBCs, nevertheless you may use small routers at remote sites behind other routers and configure phones to use them as a network gateway.

The PBX is hosted in the cloud so can't setup a VPN unfortunately.

 

[sip.bg]

If your PBX is hosted and you can't install VPN router, then the only option is to use SBC, if you need it. However, even not encrypted, usage of SBC encapsulates the voip traffic and thus adds some security, as voip call can't be observed directly with packet capture on the way.

 

[Philip Darnell]

If your PBX is hosted and you can't install VPN router, then the only option is to use SBC, if you need it. However, even not encrypted, usage of SBC encapsulates the voip traffic and thus adds some security, as voip call can't be observed directly with packet capture on the way.

Thanks for the help. I will see how we go with STUN, don't really want to add an SBC as to me its just another thing that can fail and go wrong, but obviously if STUN isn't working we will need to add the SBC.