SIP Trunk TLS to an AudioCodes SBC (3CX v20)

[Alain.R.]

Hello,
I was able to configure a SIP Trunk between a 3CX v18 and an SBC AudioCodes Mediant 800B with TLS and SRTP.
To be able to have TLS activated and working, I had to deselect the option "Enable PCI compliance SSL/SecureSIP Transport and Ciphers ..." under "Security\Anti-Hacking".
This option "Security" is not anymore available on the v20 so I cannot unselected this "PCI Compliance" option.
I didn't find any information in 3CX documentation about the prerequisite to configure TLS parameters (TLS version, Cipher, Key Exchange group, ...). I tried with TLS 1.2 or 1.3 using AES256 cipher but I still need to deselect this PCI Compliance option to avoid an error from 3CX server.
Do you have any idea about the TLS specifications requires by 3CX (to use it with deselecting PCI Compliance option) ?
Or do you know how to deselect this option in a v20 version of 3CX ?
Thanks for your help.

 

[OlegR_3CX]

Hi there.
I will try to answer on the above so,
- Strong ciphers are now forced, and you can't deselect.
- the 3CX System indeed have multiple strong ciphers available

If you use Nmpa to scan port 5061 and in the V20 you can see what are they:

| TLSv1.2:
| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A
| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A
| TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (secp256r1) - A
| TLSv1.3:
| TLS_AKE_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A
| TLS_AKE_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A
| TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519) - A

 

[Alain.R.]

Hi there.
I will try to answer on the above so,
- Strong ciphers are now forced, and you can't deselect.
- the 3CX System indeed have multiple strong ciphers available

If you use Nmpa to scan port 5061 and in the V20 you can see what are they:

| TLSv1.2:
| TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (secp256r1) - A
| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A
| TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (secp256r1) - A
| TLSv1.3:
| TLS_AKE_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A
| TLS_AKE_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A
| TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519) - A

Thanks for your answer.
I run nmap -sV -p <SBC port> --script ssl-enum-ciphers <AudioCodes SBC IP> and I got :
ssl-enum-ciphers:
| TLSv1.3:
| ciphers:
| TLS_AKE_WITH_AES_128_GCM_SHA256 (ecdh_x25519) - A
| TLS_AKE_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A
| TLS_AKE_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519) - A
| cipher preference: client
|_ least strength: A

So these are the same Ciphers between 3CX (v18 an dv20) and AudioCodes SBC for TLSv1.3.

Even though, if I activate the "PCI Compliance" on v18, I get error in 3CX related to TLS when I try to make an outbound call from 3CX (inbound call is working with TLS) :
Call or Registration to 078xxxx@(Ln.10000@AudioCodes) has failed. 0.0.0.0 replied: 503 Certificate Validation Failure; warning: No other DNS entries to try (11,0); internal

I don't know what is causing this issue :

• certificate on SBC is a not wildcard and common name is matching FQDN
• Root certificate from SBC certificate is upload in the configuration of SIP Trunk on 3CX
• TLS v1.3 with Ciphers matching

Any solution ? or log files location that could help ?

Thanks.
Alain

 

[OlegR_3CX]

Hi Alain, hope you are well.
You are welcome.
What is your issue there, are you trying to provision SBC and it does not work?

 

[Alain.R.]

Hi Oleg, I have a Audiocodes SBC Mediant connected to PSTN. Then I have configured 3CX server with a SIP Trunk to SBC AudioCodes. So outgoing calls and incoming calls are going through the SBC. Without TLS or with TLS when unselecting "PCI Compliance", everything work fine with v18.
If I enable "PCI Compliance", only incoming calls are working. But outgoing calls failed due to TLS establishment failure. On 3CX, I got the error "Call or Registration to 078xxxx@(Ln.10000@AudioCodes) has failed. 0.0.0.0 replied: 503 Certificate Validation Failure; warning: No other DNS entries to try (11,0); internal".
So I guess something with Ciphers or other TLS settings are rejected by 3CX, but I don't understand what exactly. The error message in event log above is not giving any indication.
I would like to know if there are more log files that I could use to troubleshoot.
Thanks

 

[OlegR_3CX]

You could try to check the logs using this tool, however, there is nothing much we will be able to advise on the unsupported trunk and there are no other settings to those you see in the console.

 

[Alain.R.]

You could try to check the logs using this tool, however, there is nothing much we will be able to advise on the unsupported trunk and there are no other settings to those you see in the console.

Thanks for the tool.

 

[Alain.R.]

I have upgraded my 3CX server (the first server of my HA pair of 3CX) from version 18 to 20. As explained above, I have SIP trunk to an operator through a SBC AudioCodes Mediant 800B with TLS and SRTP. With version 18, it was working. After upgrading to version 20, the TLS protocol is not establishing correctly between 3CX and SBC:


I received a Bad Certificate from 3CX server.
The certificate of SBC is not a wildcard, the root CA is installed in the configuration of the SIP Trunk in 3CX.
In the 3CXPhoneSystem.bldef file, I found the following error :
Cause: 503 Certificate Validation Failure/INVITE from local

My second server of my pair of HA 3CX server, which is not yet upgraded to v20, is still working well.
What can I do ?
Thanks

 

[OlegR_3CX]

There is nothing much we can advise on unsupported trunk.
Are you on the latest V20 RC1? Is Secure SIP service is enabled (in the Advanced > Secure SIP ), secure SIP port is up and running right as well and your SSL certificate including intermediate one is also included there?

 

[Alain.R.]

Version is Version 20.0 Update 1 (Build 731 Release).
Secure SIP enabled
Port is up as the secondary 3CX server in v18 is working well.
SSL certificate is validate directly from root CA (no intermediate).

The problem is that I don't have any information from 3CX server about the cause of rejection of the certificate. Would be helpful to have a log file to read or have a clear description of the conditions to fulfil so that 3CX accepts the certificate.