SonicWALL firewalls / Cloud hosted PBX

[Mykal]

We use Dell SonicWALL firewalls with cloud hosted phone systems in Google Cloud. Most of the documentation for SonicWALL configurations operates under the assumption that your pbx is on prem. Well after experimenting for ages regarding source port remapping etc. we thought we had it figured out but apparently not. 3CX recommends that you 1:1 nat / port forward your remote SIP and RTP ports to the local IPs of your phones and disable source port remapping all together. We typically would place our phones in a separate VLAN and disable source port remapping for that VLAN because trying to 1:1 nat / port forward 100+ phone installs would just take way too long. Does anyone else use SonicWALL firewalls and cloud phone systems that has had success?

 

[Saqqara]

Use 3cx SBC , then you only need to allow port 5090 and 443 out

https://www.3cx.com/docs/3cx-tunnel-session-border-controller/

https://www.3cx.com/blog/releases/sbc-performance/

Another solution create a site to site vpn, then you configure the phones as local

 

[Mykal]

But by putting an SBC on site wouldn't that be putting us back in the position of "Hey your entire phone service depends on this one piece of equipment" and that sort of sounds like the same situation as an on prem.

 

[cobaltit]

So you're saying if the Sonicwall goes down the phone still work?

 

[eddv123]

I have actually setup a user for one of our cloud hosted deployments this week via VPN tunnel with voice/data VLAN'S and daisy chaining of phones (using HP Aruba switches) and a Sonicwall tz300.

Worked fairly well, using DHCP option 66 provisioning.https://www.3cx.com/sip-phones/dhcp-option-66/

The only thing that took a little while to work out was to get inter VLAN routing on the Sonicwall so we could register phones up the VPN tunnel, as always once the network configuration is sorted and stable 3CX works a treat!

 

[JohnS_3CX]

Hi Mykal

If you are talking about 100+ phones and relying on STUN you will have more on your hands than setting up an SBC or two, because you need to manage a lot of ports. 3CX will tell you what the requirements for the PBX are, but the configuration of the whatever firewall you happen to have is then up to you or your partner that installed it.

The SBC is scalable and the time it takes to set it up is less than the time you already spent on the firewall.

You can set one up using the 3CX Debian ISO and try it out by moving some of your phones to provision under SBC. Compare that with your existing solution and decide what works best for your specific needs. Also consider the VPN solution which makes everything appear local and you don't have to deal with the ports

As for the on-prem argument it does not really stand, especially if you use the mobile apps, or webclient or have phones at more than one site. The cloud server will continue to work even if your whole building and phones lose power. Just by having the users pull up their mobile phone and launch their 3CX client to continue to take calls over LTE you are now back in business.

 

[eddv123]

100+ phone installs

I have set up many installs in the 100-500 user space and would only suggest you use VPN from the cloud system for this, our hosted provider offer a software PfSense on their provider platform which makes this very easy.

 

[hogan71088]

I have set up many installs in the 100-500 user space and would only suggest you use VPN from the cloud system for this, our hosted provider offer a software PfSense on their provider platform which makes this very easy.

Which provider is this?

 

[eddv123]

Virtual 1:
https://www.virtual1.com/