SonicWALL Fails in Media Server Firewall Check after following instructions

[Certified CIO]

Hi folks,
I hate to beat a dead horse here, but I would like to find an answer or understand the impact of the Media Server failing during the Firewall Check. As best as I can tell there is NO impact on making calls or system working properly.

I have our SonicWALL TZ215 running v5.9.1.7-2o (Customer Site)
I also have a newer TZ500 running v6.5.0.2-8n (Our internal site)

I have followed the following documentation (triple checked) and process deleted and repeated:
https://www.3cx.com/docs/sonicwall-firewall-configuration/

And the consistent Result:

• resolving 'stun-us.3cx.com'... done
• resolving 'stun2.3cx.com'... done
• resolving 'stun3.3cx.com'... done
• resolving 'sip-alg-detector.3cx.com'... done
• testing 3CX SIP Server... done
  • stopping service... done
  • detecting SIP ALG... not detected
  • testing port 5060... done
  • starting service... done
• testing 3CX Tunneling Proxy... done
  • stopping service... done
  • testing port 5090... done
  • starting service... done
• testing 3CX Media Server... failed (How to resolve?)
  • stopping service... done
  • testing ports [9000..9398]... failed (How to resolve?)
    • testing port 9000... full cone test failed (How to resolve?)
    • testing port 9002... full cone test failed (How to resolve?)
    • testing port 9004... full cone test failed (How to resolve?)
    • testing port 9006... full cone test failed (How to resolve?)
    • testing port 9008... full cone test failed (How to resolve?)
    • testing port 9010... full cone test failed (How to resolve?)
    • testing port 9012... full cone test failed (How to resolve?)

I get it that the Firewall Checker doesn't lie, but can we get some concrete instructions regarding what actually functions and what the impact is? So far I have 3 separate sites running over SonicWALL with the recommended setup and upgraded firmware and all of them fail at the Media Server test.

Maybe they are functional because we are using SBCs or VPN connections so the media server is not required?

Feedback from others that have successfully used SonicWALL TZ or Ubiquiti USG models appreciated. Both seem to have the same issue. So far only our Azure Virtual Server Instances do not have the "full cone test failed"...

(BTW the forum search sux. I get different answers just by re-arranging my search terms. Also I cannot search for less than about 5 words. e.g. so if I wanted to look at all "media server" messages it won't allow that search.)

 

[Certified CIO]

Bump... Anyone?

 

[cobaltit]

So I don't use Sonicwalls because I hate them so I can't tell you how to get them to work. I can tell you that I've had other IT providers set them up for our phone customers and it passes the firewall test so it is doable. Couldn't tell you versions or models though.

As far as failing and whether that's a problem, that depends. So I guess first of all it matters if you your voice is actually traversing the the firewall. Secondly, this is a straight firewall test to 3CX. If your SIP trunking provider has a SBC (which most due) then that will usually resolve any issue. The bigger problem would be STUN phones since you are at the mercy of the Sonicwall.