SIP-ALG

[DrainBamaged]

Branch office in Europe. With SIP--ALG disabled on the firewall we cannot connect calls. No ringing and no call connection indication on the 3CX web panel.

When SIP-ALG is enabled, calls connect fine. Same firewall vendor and software version that we use in all other offices and those work fine. Am wondering if this is a SIP issue on the provider side as they had us set up quite a few outbound parameters(?)

Anyone ruin into this before?

v16.0.9 Enterprise.

 

[Evolute IT]

Where is the PBX hosted?

Are you using an SBC?

What are the phones?

Who is the trunk provider? Even though it shouldn't cause this issue when playing with the trunk parameters.

 

[big.LITTLE]

Ours too, PBX is hosted on the cloud, no SBC, phones are connected using WAN.

Without SIP ALG, phones are playing up, not found, cannot make outbound calls, etc.

As soon as SIP ALG enabled, phones are behaving normally.

 

[cobaltit]

Use a SBC, case closed.

 

[JohnS_3CX]

You can either use the best option available, as @cobaltit mentioned

Or you can go into the unnecessary trouble of doing STUN the right way

 

[Evolute IT]

It sounds like the phones were configured to all use the same ports without any port forwarding correctly done. Thus why SIP ALG helps a bit, but it is not supported and cannot be predictable, so I would recommend as above: go SBC.

STUN should only be the last resort.

 

[DrainBamaged]

The phone I used for testing was an Android cell phone app. We have no hard phones remote from the office, just softphones and iOS / Android apps. All extensions have the port 5090 tunnel option selected.

3CX is hosted locally in the office. We do not use an SBC as we only use the 3CX apps.

 

[NickD_3CX]

The phone I used for testing was an Android cell phone app. We have no hard phones remote from the office, just softphones and iOS / Android apps. All extensions have the port 5090 tunnel option selected.

3CX is hosted locally in the office. We do not use an SBC as we only use the 3CX apps.

Could you help us understand the issue a little better?
First of all, as you opened this thread in the "SIP Trunking" category, I'm assuming that this is only happening with external calls.

Could you please confirm this, that with extension-to-extension calls everything is fine, but the issue is with incoming/outgoing external calls?

Also, has the Firewall Checker passed with SIP ALG disabled?

Last, which SIP Trunk provider are you using?

 

[DrainBamaged]

Hi Nick,

As this error is encountered with the SIP-ALG function, I felt the SIP section was the best fit.

I did not try ext - to - ext as that would either be routed on the bridge tunnel between offices or internally if both are on the same PBX, not over the SIP. The app registered with the server, I tried to call the office main line using my cell phone.

I made the SIP-ALG change on the FW to get the FW checker to pass and was surprised to see no calls could get through. We have another office in the same country with their own 3CX server (on the same SIP provider) and I tried the same thing on that firewall as well. Same result, no calls went through when SIP-ALG is disabled.

We use the same FW hardware and rules in other offices without issues. The trunk provider is in the pull down list as an official 3CX SIP. I can't give you more info publicly due to policy. Please PM me for the country / provider specifics on that.

 

[NickD_3CX]

So with SIP ALG disabled, the Firewall Checker passes. That is good news.

If you don't feel comfortable saying publicly which SIP Trunk provider you are using, that's fine, send me in a PM, maybe we have any notes about them.

Generally though, I would check that:

• In the SIP Trunk Settings --> Options, that the "Put Public IP in SIP VIA Header" option is disabled (unlesss your provider explicitly requires it) and that "Select which IP to use in 'Contact' (SIP) and 'Connection'(SDP) fields" option is also set to "Use Default Settings" (unless you have a specific reason for not having it like that)
  
• In Settings --> Network, check that your Public IP is set to Static and that there is the correct IP there.