Single Remote IP Phone Presence

[FireMedic]

I have a single remote IP phone (Yealink T46S) that I am trying to connect to a remote on-prem 3CX server. In the past I've setup a VPN to handle this but I'd like to avoid this to simplify setup for remote/home office workers. I don't really need an SBC or router phone setup since there's only 1 IP phone on-site so I'm not needing to handle local phone-phone traffic and combine traffic into a single tunnel. I pointed the phone to the public FQDN of the server and it connects fine and I can make/receive calls. However, presence is not working. I have a custom port (TCP 5005) setup for presence and it is forwarded/allowed through the firewall and the 3CX firewall checker passes.

If presence works through the VPN tunnel using the local IP of the 3CX server, I'm curious what ports need to be open for the presence to work remotely via the FQDN. I had thought the presence port (default of 5001; 5005 in my setup) but it doesn't seem to work. Any help?

 

[paulodagraca]

Hello @FireMedic ,

There is no Presence Port specifically.

The 3CX does use the HTTPS port, by default 443/5001 TCP port.
And the Tunnel Port, by default 5090 TCP and 5090 UDP.
This should be all you need.

That the Yealink T46S IP Phone does work fine on the STUN configuration, has nothing to do with the above ports. That is two differend things.

Question, when you say 'presence not working', where are you looking/testing exactly?

Paulo

 

[JohnS_3CX]

I don't really need an SBC or router phone setup since there's only 1 IP phone on-site so

1. Quite the opposite: that's a perfect example of when you typically need a router phone and you should go ahead and install one for this user.

2. Presence does not exist on IP phones, this is exclusively a 3CX application feature not found on phones.

3. I assume you are probably talking about BLF which is not presence, it is call state (idle/ringing/busy, ergo BLF=Busy Lamp Field).

Do you have a router capable model available on some other user perhaps? If so just try and swap it for one and give it a go

See models in each guide here, you might already have one available https://www.3cx.com/sip-phones/

 

[FireMedic]

Hello @FireMedic ,

There is no Presence Port specifically.

The 3CX does use the HTTPS port, by default 443/5001 TCP port.
And the Tunnel Port, by default 5090 TCP and 5090 UDP.
This should be all you need.

That the Yealink T46S IP Phone does work fine on the STUN configuration, has nothing to do with the above ports. That is two differend things.

Question, when you say 'presence not working', where are you looking/testing exactly?

Paulo

By presence I mean the busy/available status on the BLF keys.
The 3CX firewall configuration page references port 443 or 5001 TCP for "Presence and Provisioning". I'm using port 5005 TCP (since 5001 conflicts with Synology NAS units' default port).
I'm trying to understand why the presences/BLF status works over a VPN tunnel but not over the WAN since I'd like to simplify setup without a VPN for a single remote phone (for work from home scenarios).

 

[FireMedic]

1. Quite the opposite: that's a perfect example of when you typically need a router phone and you should go ahead and install one for this user.

2. Presence does not exist on IP phones, this is exclusively a 3CX application feature not found on phones.

3. I assume you are probably talking about BLF which is not presence, it is call state (idle/ringing/busy, ergo BLF=Busy Lamp Field).

Do you have a router capable model available on some other user perhaps? If so just try and swap it for one and give it a go

See models in each guide here, you might already have one available https://www.3cx.com/sip-phones/

Yes I'm meaning the BLF status.
My understanding of an SBC or router phone was that they facilitated local connections between phones on site (e.g. extension to extension calling without going to the remote 3CX server and back) and allowed a single connection from the remote site to the 3CX server. If I have only one phone at the remote site, there's no local connection to facilitate and there's no benefit to tunneling everything through a single connection when there only one connection anyway.
I'm trying to understand why the BLF status works over a VPN tunnel to the 3CX server but not over the WAN when I have 5060, 5061, 5090, 443, and 5005 (my custom port for Presence/Provisioning) forwarded from WAN to the 3CX server. I had thought the BLF status traffic went over the Presence/Provisioning port but it seems that's not the case since I have that port forwarded?

 

[paulodagraca]

Hello FireMedic,

So it is clear that you want the DSS/BLF keys to work on the Yealink T46S - IP Phone.

The strange part is that the BLF works on the same SIP protocol as the the phone REGISTER.
There is no special BLF IP Port to check, because it works on the existing SIP port for the IP Phone.

So if the IP Phone can register corretly at the 3CX Server, than that would mean it could perfectly also reach the 3CX server on the next packet for the NOTIFY (BLF information).
I would see no reason why one SIP IP packet would work perfectly and not the next, as it is the same transmittion.
So something must be wrong in the setup of the phone or the firmware on the phone is not correct.

1) Please check the 3CX website for the correct firmware you need to have on the Yealink T46S IP phone.
https://www.3cx.com/docs/phone-firmwares
Please use the TESTED firmware, that is created to work perfectly with YEALINK and 3CX on this website.
(if correct firmware is in use, skip this part)

2) Delete phone from extention on the 3CX and create again.

3) Factory reset the Yealink IP phone, where it should get the new setup configuration from the 3CX server.

This should get your Yealink IP Phone working fine again.
Please note, there is no special port or setup for BLF keys, it works on the SIP port (5060).

Paulo

 

[SweetAction]

My understanding of an SBC or router phone was that they facilitated local connections between phones on site (e.g. extension to extension calling without going to the remote 3CX server and back) and allowed a single connection from the remote site to the 3CX server. If I have only one phone at the remote site, there's no local connection to facilitate and there's no benefit to tunneling everything through a single connection when there only one connection anyway.

While all this is true, there's 2 more benefits you are missing which is the sole reason you should deploy a router phone in your setup.
1. No need to handle inbound NAT to the phone. Yes, even a single phone can benefit as it can use itself for going over the tunnel.
2. No troubleshooting weird port forward issues to the server (which is what you are doing right now).
3. No port forwards increases PBX security (or simplifies your port forwarding rules because you don't need to maintain a list of allowed IPs.

I only know of 1 reason why someone doesn't want to deploy a router phone.... and that's the phone doesn't support it and they don't want to buy a new phone.

Ask yourself this. A T43U renewed on Amazon US right now is $58.... is the time you spend working on this issue worth saving $58?

So why don't you want to use a Router Phone?

I'm trying to understand why the BLF status works over a VPN tunnel to the 3CX server but not over the WAN when I have 5060, 5061, 5090, 443, and 5005 (my custom port for Presence/Provisioning) forwarded from WAN to the 3CX server.

This is also your answer. Something isn't working correctly with your forwarding (and it's likely how traffic from the PBX is getting back to the phone (i.e. NAT on the phone side network)).

 

[paulodagraca]

Hello FireMedic,

The SBC is an device that you described perfectly, that will serve IP Phones on the Local LAN, to connect over the 5090 tunnel port to the 3CX (just like an VPN tunnel).

If you have only one IP phone, the routerphone can create it's own SBC tunnel without the 'extra' SBC device.
You would only need the phone itself, and nothing else to work, and yes it conveniently can support a few other devices as well if they are on the same LAN.

So the router phone is NOT a direct SBC replacement, but can do this job as well for itself and a few other devices.
This is also an easy setup for phones, that are moved around between sites, as they do not need to depend on the local SBC (if there is one), to opperate perfectly.

For other people that may be reading this:
Single IP Phone setup, definetly use a Router Phone.

Paulo

 

[JohnS_3CX]

My understanding of an SBC or router phone was that they facilitated local connections between phones on site (e.g. extension to extension calling without going to the remote 3CX server and back) and allowed a single connection from the remote site to the 3CX server.

Ah ok the oversimplification is what caused you to think that it's not necessary when in fact it is.

Here is what it actually does https://www.3cx.com/docs/3cx-tunnel-session-border-controller/

Your VPN was essentially serving the same function, so if you don't want to keep the VPN, get a router phone and you're done.

 

[VoIPTools]

There are some packet consolidation as well, so less bandwidth demands vs standard SIP.