SIP trunk does not register using proxy IP and TLS

[PHSnet]

Hi!
I encounterd the following problem using current V16.0.8.16 on Windows 10.
Our provider "3" in Austria provides a proxy without a domain name (just IP address and custom port). The realm is a FQDN. IPv4 Protocol is TLS only, a certificate is provided.
After configuring the SIP trunk 3CX is not registering at all (type of authentication is set to register and user/pass is entered), which means there is no IP traffic sent to the proxy and also no log messages on 3CX.
After 2.5h of troubleshooting I changed the proxy from IP to a custom FQDN and entered a static enty wich resolves this FQDN to the IP on my router (which is DNS server for the Windows 10 host in this case) and after restarting the SIP service the trunk was registered. Even after a reboot of the whole host the trunk registered again.

So I was able to do a workaround to get it running but it seems there is an issue. I've found a similar thread in this forum here.

Maybe also interesting to see that if the protocol was changed to UDP or TCP the 3CX instantely tries to register (which of course then failed in my case because provider does only support TLS).

Can someone confirm this behavior and if it's a bug, when will it be resolved?

br Phil (I'm new to 3CX, but well expirienced in networking, Windows and did a lot with sip voip ~12y ago)

 

[YiannisH_3CX]

Hello @PHSnet

The behavior is exactly as you described. For TLS 3CX needs an FQDN in the registrar and it you are using a proxy in there to. If you use an IP address then the PBX will not try to register when using TLS as your transport.
This is the expected behavior, it's how it was designed and it is not a bug.

 

[PHSnet]

thanks for quick answer. It took me some hours to find this out. Is it somewhere written too?

 

[YiannisH_3CX]

Unfortunately not at this time but we plan on creating an entire document for TLS as it is gaining traction lately. Until then that is why we are here so please feel free to ask us anything.

 

[Evolute IT]

Unfortunately not at this time but we plan on creating an entire document for TLS as it is gaining traction lately. Until then that is why we are here so please feel free to ask us anything.

Maybe plan to add the SRTP and Transport options in a phone provisioning config. SRTP is already in the templates but just not used.

SIP TLS is indeed more and more popular.

 

[PHSnet]

Hello @PHSnet

The behavior is exactly as you described. For TLS 3CX needs an FQDN in the registrar and it you are using a proxy in there to. If you use an IP address then the PBX will not try to register when using TLS as your transport.
This is the expected behavior, it's how it was designed and it is not a bug.

I'm just interested in why a FQDN is necessary to register? What is the reason behind this design decision? Is it a security thing?

 

[Evolute IT]

I'm just interested in why a FQDN is necessary to register? What is the reason behind this design decision? Is it a security thing?

Because that's how TLS works? With "hostnames", or FQDNs. Not with IPs.

 

[YiannisH_3CX]

I'm just interested in why a FQDN is necessary to register? What is the reason behind this design decision? Is it a security thing?

Its a requirement of our SIP engine I am afraid. Even though your registrar is an FQDN the proxy must also be an FQDN.