Secure-SIP TLS error + hundreds of extra phone instances

[nienunb]

Hello everyone,

After following the exact directions from the 3CX blog regarding Secure-SIP (http://www.3cx.com/blog/voip-howto/secure-sip), we've been experiencing some weird things.

We're running ver. 8.0.10824.716 of the phone system, using Snom 320 phones (fimware 7.3.14).

Every time a phone registers, this messages is generated in the server activity log (there are 3 extensions registering in the snippet below, ext. 201, 208 and 216):

Kindly place all logs in code and /code tags - MFM

09:26:53.061  Got TLS read ret=0 error=5 error:00000005:lib(0):func(0):DH lib
09:26:44.967  [CM504001]: Ext.208: new contact is registered. Contact(s): 
[sip:[email protected]:2936;transport=tls;line=pclz0ezg/208,sip:[email protected]:2935;transport=tls;line=pclz0ezg/208,
sip:[email protected]:2932;transport=tls;line=pclz0ezg/208,sip:[email protected]:2934;transport=tls;line=pclz0ezg/208,
sip:[email protected]:2933;transport=tls;line=pclz0ezg/208,sip:[email protected]:2930;transport=tls;line=pclz0ezg/208,
sip:[email protected]:2931;transport=tls;line=pclz0ezg/208]
09:26:16.935  Got TLS read ret=0 error=5 error:00000005:lib(0):func(0):DH lib
09:26:14.154  [CM504001]: Ext.216: new contact is registered. Contact(s): 
[sip:[email protected]:2866;transport=tls;line=v9i7uj4n/216,sip:[email protected]:2865;transport=tls;
line=v9i7uj4n/216]
09:26:03.435  Got TLS read ret=0 error=5 error:00000005:lib(0):func(0):DH lib
09:25:52.810  [CM504001]: Ext.201: new contact is registered. Contact(s): 
[sip:[email protected]:2058;transport=tls;line=beps9t51/201,sip:[email protected]:2056;transport=tls;
line=beps9t51/201]

Also, before enabling SecureSIP/TLS per the blog post, each Snom phone was shown ONCE in the Phones section. Now, there are literally HUNDREDS of instances of EACH PHONE in the Phones section.

We are thinking of rolling back to UDP without using TLS, but would rather not.
If anyone has any suggestions, or comments, please let me know! I appreaciate your help.

Nienunb.

 

[dukejames]

When I said "External to PhoneSystem", I meant that I created port forwarding rules designated from the Internet to the 3cx PhoneSystems Ip Address. "PhoneSystem to External" meant that I designated port forwarding rules from the 3cxPhoneSystems IP address to any IP address on the internet needing those port numbers.

I'll remove the 7000-7500 port forwarding rule. I opened this because in my test using a different firewall, packets were being blocked within this range and I wasn't getting any audio. At the time, I was connecting to a 3cx phonesystem from a DMZ. I was only hoping it would help in my current situation with TLS from the internet.

 

[dukejames]

The ports suggested were rules previously integrated but did not solve the issue. When I started from the ground up with the second firewall, I noticed that port 5090 tcp/udp and 3478 udp weren't being blocked. Only when used from the 3cx PhoneSystem during a Firewall Check. Are they used by the Phone client to access the system from the internet?

Otherwise, I'm still on the same boat. :cry:

 

[nb]

What is the firewall?

Remove 3CX from DMZ and let me know. Just make standard port-forwarding.

 

[dukejames]

I think I may have confused you.

There are 2 different environments. One is production where I want everything to work and the second was a test environment, where the 3cx phone was in a DMZ. The second environment was for testing purposes only.

Right now, I'm only working with the production environment. There is no DMZ in the production environment. The type of firewal I'm using is ClearOS.

 

[nb]

So if you capture this call, what do you get as a result? Can you send me a cap without secure sip first, and then with secure sip so I can try and compare?

[email protected]

 

[dukejames]

I'm sorry, but when you say 'cap' do you mean a WireShark report? Or do you mean 3cx server activity?

 

[nb]

capture with wireshark yes - without tls. Another with tls

 

[matictec]

What version of 3CX Are you using?
Did you ever get this working? probably there is a problem with the certificate.

It seems that the 3CX phone do not support certicates from CAs like GeoTrust or Versign. Only the self created root ca "3CXPHONE" is supported. with snom phones it works correctly, even with certificates from versign and so on. would be nice if the basic root ca certificates would be implemented in 3cx phone or that the windows integrated root certificates would be used.

 

[dab]

or that the windows integrated root certificates would be used.

+1 this would be really nice