Sophos Firewall with 3cx

[oneroit]

Good Day,

i have a client that is setup on a 3CX hosted Linux system offsite, it is pointing to a Sophos XG firewall at the customers premises with 35 Users with the firewall checker everything passes.
the phones are Yealink T40g and T46G. The phones will only provision if i login to the phone WUI and register. the only issue is then i have no control over the phones remotely when needing to make changes on the users and firmware updates.
they also have some users at remote branches which connect also through a Sophos firewall to head office. i have tried setting up one or two of these users with STUN and on the 3cx Management console it shows as delivered then phone then shows the extension number and name but no service.
the user is setup via STUN
Disallow is unchecked
PBX Deliver Audio is checked.

Has anyone else had this kind of problem

 

[Saqqara]

Save yourself the hassle setting the phones using stun , install SBC server which manages the network connections. - https://www.3cx.com/docs/3cx-tunnel-session-border-controller/

 

[oneroit]

Save yourself the hassle setting the phones using stun , install SBC server which manages the network connections. - https://www.3cx.com/docs/3cx-tunnel-session-border-controller/

Hi Saqqara,

thank you that makes sense with the remote users.

have you used the Sophos firewall before, as most of my setups are with the phones linking to a Mikrotik with a VPN Tunnel the phones are then VLANed and provision to the Hosted 3CX server without any issues. yet with the SOPHOS XG we are battling.

 

[Ronin]

Hello Oneroit,

Do you also have Sophos RED boxes? Perhaps you need to activate DHCP option 66.

 

[oneroit]

Not to sure.

The IT guys do the 3cx Install on the Linux machine at our Data center.

so the 3CX server sits behind a Mikrotik at the Data center, which then is pointed to the client's site that has the Sophos XG as well as a Mikrotik. The phones onsite will not provision unless i login to the phones WUI and manually provision.

we had this issue before with the mikrotiks until we managed to setup the VLAN on the Mikrotiks, and it worked perfectly.

IT guys are lost at this moment.

 

[Ronin]

You can ask them to check the DHCP option 66 in Sophos XG. Maybe this has to be enabled. If so, this is done in cli.