SIP ALG suddenly failing?

[benf]

Hi all, I have a bunch of 3CX servers in our datacenter and also a few on-premise. Most of them are behind Sonicwalls and a couple behind PFSense. My last one was setup a week ago, and I just set one up today. When I run the FW check it fails SIP ALG. This is going out the same firewall with the same config as about 7 other devices. So I go back and cross-check everything is the same, I run the FW Check from the one last week that was green, it also is red on SIP-ALG. I goto an on-premise , it runs and fails SIP-ALG, I goto the one we use which is on 16.0Beta, using a PFsense, and it also fails. So I am sure that no one modified 8 different firewall rules across 3 different firewalls in the past week. I thought maybe an update (we are set to auto-update) on 15.5 but my other is on 16.0 so clearly thats not it .. I dont think this is a firewall rules issue, Im wondering if maybe DNS or whatever 3CX ALG 'check' needs on the WAN side (like a 3cx owned server) is not working?

 

[cobaltit]

Just ran the firewall check on our instance (Azure VM) and it passed so the ALG service/check on 3CX side seems to be working for me.

 

[benf]

So this is funny, I am on the same network, I am testing a Windows 3cx 15.5 install, going out the same Sonicwall as the other 2 and it passes. This is simply a 1:1 NAT with a '3CX GROUP' rule for all the servers. 2 Linux = fail, 1 Win = pass. I just went back and checked the linux servers and they are all passing now. So Im going to chock this up to a 3cx issue on the WAN, nothing internal. Nothing has been changed and all of my instances are successful.

 

[YiannisH_3CX]

Hello @benf

Glad to see the issue has now been resolved. Just for future reference there are 3 possible values you can get back from a SIP ALG test. The first is PASS which is self explanatory. The second is Detected which means that the FW checker has detected SIP ALG. The third is FAILED which means that the test could not be completed for some reason. It could be that the reply never made it back to the PBX so the test was inconclusive or the service was under maintenance at the time etc.