SBC Role when installed on a VPN Network

[JMP]

Hi
a little background I have 3cx Standard 15.5 (free version) Installed on a VM (windows server 2012) on one leg of a 7 location VPN (Managed Cisco 881) I have been testing with 4 Yealink T21 P phones On remote extensions. I have successfuly installed windows client and web client instances of C3X. The phones are proving to be a bigger challenge. So far I have factory reset them and applied latest firmware 52.84.0.15 I have manually provisioned them using the URL from management console confirmed provisioning via new web login and the phones now have the 3CX phone book on the display. The phones are not registering. On the phone web interface is says registering however registration failed. After combing through forum and instructional videos I came to the conclusion i need to install a SBC at each VPN location. After doing that and seeing the SBC ip populate in the Yealink web interface still no joy. After more reading I realized that port 5900 needs to be open on VPN remote location. Because this a managed network I made the request and will test once the port is open. I am seeking any wisdom for setup on vpn locations. Should I use the Bridges feature and install on premises instances at each location or use a cloud provider ,or continue with one on premise install (for now) ? I could also go with a second router subnet hosting just ip phones and use SBC to connect branches (if I am understanding correctly) Sorry for the long explanation I have spent a fair amount of time researching before making this post. I guess in a nutshell I am looking for "best practise"

Thanks
Julian

 

[Mark Phillips]

You do not need to use SBCs when using a VPN. Critically you have to get your TCP/UDP ports set up correctly as you have noted. PnP provisioning won't work over a WAN, but you simply have to add the phone's MAC addresses into 3CX and ensure your local DHCP servers have option 66 set so that the phones know where to find the 3CX server to pick up the provisioning files.

 

[Saqqara]

As above , as long as all ports are allowed thru the vpn tunnels. If not then you need to open up ports, this will help you which ports are required https://www.3cx.com/docs/manual/firewall-router-configuration/ - remote phones. Add port 5001 and 5000 to the list

On the provisioning tab, what is the lan setting - iip address of 3cx server or fqdn. If fqdn, make sure that it resolves correctly to the internal 3cx ip address on the remote lan network. You need to setup spilt dns https://www.3cx.com/docs/creating-fqdn-split-dns/

Info on dhcp https://www.3cx.com/sip-phones/dhcp-option-66/

Info on setting up these phones - https://www.3cx.com/sip-phones/yealink-t20p-t22p-t26p-t28p/

 

[JohnS_3CX]

Hi Julian,

You may possibly need to check the limitations here:
https://www.3cx.com/sip-phones/yealink-t20p-t22p-t26p-t28p/#h.e2e9dlym4hi8

The T21P phones do not support Let's Encrypt certificates so you will not be able to use PnP and get them to register unless you disable the SSL Transport and Ciphers under your dashboard's Settings > Security

The newer model should be ok (E2)

 

[JMP]

As above , as long as all ports are allowed thru the vpn tunnels. If not then you need to open up ports, this will help you which ports are required https://www.3cx.com/docs/manual/firewall-router-configuration/ - remote phones. Add port 5001 and 5000 to the list

On the provisioning tab, what is the lan setting - iip address of 3cx server or fqdn. If fqdn, make sure that it resolves correctly to the internal 3cx ip address on the remote lan network. You need to setup spilt dns https://www.3cx.com/docs/creating-fqdn-split-dns/

Info on dhcp https://www.3cx.com/sip-phones/dhcp-option-66/

Info on setting up these phones - https://www.3cx.com/sip-phones/yealink-t20p-t22p-t26p-t28p/

Thanks Turns out doing a nslookup on the server where the remote extension is installed came back as local gateway router. I created a split DNS record. FQDN now points to 3CX server on different subnet. As a result phone now is registered. I can call the extension and will test it further. These phones are T21-E2 so I should be able to setup DHCP option 66. I provisioned this one Manually.
Thanks again for your help!