Well, I can say that setting this up initially was a headache. But its works great at our site under a NSA 240.. (Using the Enhanced Firmware version)
I'm running under VLAN's on the sonicwall, which made my setup a little more complicated but you'll have to route VOIP traffic directly to the PBX server. I also auto provisioned my phones through the DHCP server scopes of the Sonicwall.
Things to make note of:
- Make sure you create a Address Object of your PBX Server
Next
- Make Service Objects of all the ports used for 3CX - to cover all bases (
http://www.3cx.com/forums/the-portforwarding-faq-hope-this-gets-a-sticky-1697.html)
- Then make it into a Service group.
Next
- Most important are the NAT policies and Firewall rules. Once you allow the traffic you need to route it appropriately; in this case it's the PBX server.
In your Firewall Access Rules you need to have traffic from the WAN zone allowed to your LAN zone (or the zone you have the 3CX system, in my case a VLAN zone named 3CX). This is where you'll using the Service group you created and allow it to the zone. Make sure you have the "destination" (when you add the rule) as your "WAN interface" - This can be "WAN Interface" or "X1 IP". Once thats done you can move onto NAT polices.
Next
The NAT polices. Route the traffic correctly. You'll want to create a reflective policy after the first one is done.
So start with your inbound policy:
INBOUND:
Original Source: Any
Translated Source: Original
Original Destination: X1 IP or WAN Interface
Translated Destination: This is the Address Object of your PBX Server
Original Source: This is the Service Group you created
Translated Source: Original
Inbound Interface: X1
Outbound Interface: Any
Comment: Anything you want but denote it's Inbound
Check Enable NAT policy (of course)
And Check Create a reflective policy
OUTBOUND:
The only thing you need to change on the reflective policy is the inbound interface to the interface of the 3CX server and the outbound Interface to X1 and the Comment to Outbound.
IP HELPER:
Another thing that helped is putting the UDP port "5060" under IP helper. This will help with relaying the port correctly.
After that you need to goto the VOIP Settings of the sonicwall. I found that this is pretty much useless but I did keep Consistant NAT enabled. Everything else is disabled. SIP transformations might be something I'll try to get to work because it would be nice to see activity inside the sonicwall about VOIP traffic.
My setup was actually on two Layer 2 switches so in order for my phones to register I had to hard code the ports used on the switch to the appropriate VLAN. After that I made a few adjustments to the 3CX software.
3CX Software:
On each extension I had to uncheck "Disallow use of extension outside the LAN" - Mostly likely because of my VLAN setup.
Checked "Allow non-sequental RTP port" under General->Firewall
-------------------------------------------
And thats about it.. Everything is working aside of some customization I need to do to the phones but we're live. I even have my iphone 3CX app working correctly (even on 3g..)
Hope this helps..!! :shock:
-Tim
