SBC / 3cx to external phones, bridge to hosted 3cx, SIP providers

[imadam]

Hi,

I am new to 3cx world and I am trying to figure out which SBC to use to connect to SIP providers. We usually have public DMZ where we put one port from SBC and another in VLAN of the VOIP system. However, I have downloaded SBC ISO from 3cx but looks like it is only for phone?

Also, what is best way to connect on-premise 3cx to hosted 3cx as far as security is in question.

Thank you.

 

[SweetAction]

3CX doesn't recommend a SBC between the PBX and the SIP Trunk. Instead they recommend connecting direct from the PBX to the Trunk and locking down 5060/5061 to allowed IPs if you wish with the firewall in front of the PBX.

You can use a SBC, but it's unsupported and 3CX leaves it up to you to configure.

 

[imadam]

@SweetAction thank you for reply. Looks like 3cx is confident with their built in security . Which is fine. I am used to put SBC in front of each installation since we work over public DMZ routed with firewall. I have situation where I have to connect to internal 3cx:
- SIP provider with their own fiber optic link towards customer with their own set of private routed IP (not accessable from internet)
- SIP provider coming over internet link
- external customer's users using SIP phone and mobile 3cx app

With SBC this is easy game for me. I put one port of SBC to each network and one port next to VOIP system and get all things done on SBC. How this should be done with 3cx?
Thank you.

 

[SweetAction]

I mean you can still use a SBC and connect 3CX to the SBC and the SBC to the various trunks, it's just not a officially supported config. But unless those providers are on the list here https://www.3cx.com/partners/sip-trunks/ it's not a supported config no matter how you connect everything (sbc or not).

Don't let an unsupported config scare you - just understand that 3CX won't help (but plenty of partners will, including ones on this forum). End of the day, as long as it's SIP, you can make it work usually - but you'll have to do some advanced troubleshooting sometimes.

If you are going to use a SBC - connect everything to the SBC, connect the SBC to 3CX as a "generic trunk", and away you go. Deploy 3CX per their guides / setup and 3CX itself is supported (but not your trunks). This is the better approach BUT it adds one more piece in the puzzle. That piece usually has a cost and additional administration / complexity. We do this often with AudioCodes devices when the customer needs both routing to 3CX and a second PBX.

If you are not going to use a SBC, you'll need to have a couple of NICs in the PBX. One on the private link and one on the lan (that has internet) link. Make sure in the OS that only one NIC (the lan/internet one) has a 0.0.0.0/0 route defined and that the OS knows how to route the private link IPs over the correct interface (check your routing table and adjust as needed). Connect the SIP trunks like normal - 3CX replies on the OS for the actual routing.

For phones, apps, etc - you'll be connecting that via the lan/internet link. Port forwards as described in the 3CX docs are needed.

In short, you'll be doing everything the 3CX way except a second NIC for the non-public trunk with some very specific routes for that provider to use that second NIC. Everything else goes over the primary NIC that's on LAN with port forwards (no need to DMZ the box, but you can if you want). This is the cheaper approach, but it's not supported by 3CX at all (2 NICs on the PBX is unsupported).

Let us know how you get on / if you need more clarification on this.

 

[imadam]

@SweetAction
Hi,
sorry for late reply. Got sick so I had to lay down for few days. As far as you post, thank you for your time. Few things from my side so If you find time to reply, it would be appreciated.

But unless those providers are on the list here https://www.3cx.com/partners/sip-trunks/ it's not a supported config no matter how you connect everything (sbc or not).

no provider listed in my country so I guess I am dead in water?

If you are not going to use a SBC, you'll need to have a couple of NICs in the PBX. One on the private link and one on the lan (that has internet) link. Make sure in the OS that only one NIC (the lan/internet one) has a 0.0.0.0/0 route defined and that the OS knows how to route the private link IPs over the correct interface (check your routing table and adjust as needed). Connect the SIP trunks like normal - 3CX replies on the OS for the actual routing.

So is installed 3cx with multiple adapters supported or not? You got me confused.

In short, you'll be doing everything the 3CX way except a second NIC for the non-public trunk with some very specific routes for that provider to use that second NIC. Everything else goes over the primary NIC that's on LAN with port forwards (no need to DMZ the box, but you can if you want). This is the cheaper approach, but it's not supported by 3CX at all (2 NICs on the PBX is unsupported).

As you can see, you are saying second NIC is not supported but in previous quote you are saying multiple nics

Is there 3cx supported configuration for this setup? That's my main concern now ‍ since after reading your reply, my understanding is whatever I do it will not be supported by 3cx

 

[SweetAction]

no provider listed in my country so I guess I am dead in water?

Check under worldwide, but if there is no supported provider... then no matter how you do it your trunks will not be officially supported.

So is installed 3cx with multiple adapters supported or not? You got me confused.

Multiple NICs is not supported by 3CX support team, but the software will work with it provided you get it configured correctly.

As you can see, you are saying second NIC is not supported but in previous quote you are saying multiple nics

Correct, it's not supported. You can still do it, just remember what I said here:

I mean you can still use a SBC and connect 3CX to the SBC and the SBC to the various trunks, it's just not a officially supported config. But unless those providers are on the list here https://www.3cx.com/partners/sip-trunks/ it's not a supported config no matter how you connect everything (sbc or not).

Don't let an unsupported config scare you - just understand that 3CX won't help (but plenty of partners will, including ones on this forum). End of the day, as long as it's SIP, you can make it work usually - but you'll have to do some advanced troubleshooting sometimes.

Is there 3cx supported configuration for this setup? That's my main concern now ‍ since after reading your reply, my understanding is whatever I do it will not be supported by 3cx

It doesn't sound like there is a supported config for your setup - unless you find a provider on the list in this link: https://www.3cx.com/partners/sip-trunks/
So if you are going to go the unsupported route, you have to pick which way you go - either using multiple NICs or using a SBC. I recommend the SBC route as there is less that's unsupported - but it does add cost/complexity.

Hopefully that helps.