Try Out the New 3CX SIP ALG - Firewall Check

[StefanW]

3CX is calling all implementers to try and test the new SIP ALG and let us know their thoughts and results on our forums. With the beta of version 15.5 SP1 the firewall checker has been extended to check if the firewall executes SIP ALG or not. This feature will be helpful to every user implementing 3CX while using SIP Trunks and remote (STUN) IP p...

Continue reading the Original Blog Post.

 

[AdamTTG]

An external application which does the same would be great, so it can be used at test sites to make sure SIP ALG is off.

 

[StefanW]

dont worry, we will have you covered in the second step to ensure a remote side is running SIP ALG or not....

 

[AdamTTG]

Sweet!

 

[jem1]

I have a suspicion that one of our customers on 3CX who has issues (the SIP provider had to put in work arounds) has SIP ALG running on the ISP end as the ISP admitted they used Mikrotiks and at least one has SIP ALG running, I can't wait for this check to be built in plus the second part, I'd love to test it and then fire back at the ISP because they have caused our customer so much grief with VoIP registrations dropping.

 

[StefanW]

I have a suspicion that one of our customers on 3CX who has issues (the SIP provider had to put in work arounds) has SIP ALG running on the ISP end as the ISP admitted they used Mikrotiks and at least one has SIP ALG running, I can't wait for this check to be built in plus the second part, I'd love to test it and then fire back at the ISP because they have caused our customer so much grief with VoIP registrations dropping.

it is already in the beta, just start the firewall checker from the Dashboard again and it is there! But you pin pointed the reason out why we added it!

 

[jem1]

it is already in the beta, just start the firewall checker from the Dashboard again and it is there! But you pin pointed the reason out why we added it!

Not going to put a customer on beta release. However I am running it at home with a Sophos XG Firewall and it had SIP alg turned on by default and it can only be turned off by CLI.

https://community.sophos.com/kb/en-us/123523

After i unloaded the SIP module the SIP alg detector did not find SIP ALG anymore!

Also our Barracuda F80 firewall has SIP ALG turned on by default in the rules, when I get a chance i'll test it here at work, as the rules are turned off at the moment and we have SP1 Beta loaded.

 

[3puntozero]

The test fails with pfSense firewall.
The version I've checked is 2.3.4-RELEASE-p1

 

[GarethM]

SIP ALG test fails with TP-Link WD9977, confirmed SIP ALG unticked in router advanced settings

 

[3puntozero]

The test fails with cloud servers hosted by OVH too.

 

[Steven Cage]

The 'Detecting SIP ALG' test fails with a Cisco Meraki MX80.

 

[nb]

An external application which does the same would be great, so it can be used at test sites to make sure SIP ALG is off.

You care only to see if there is a sip alg on the network bordering the pbx. You do not need to test other sites. At least for now.

 

[nb]

Not going to put a customer on beta release. However I am running it at home with a Sophos XG Firewall and it had SIP alg turned on by default and it can only be turned off by CLI.

https://community.sophos.com/kb/en-us/123523

After i unloaded the SIP module the SIP alg detector did not find SIP ALG anymore!

Also our Barracuda F80 firewall has SIP ALG turned on by default in the rules, when I get a chance i'll test it here at work, as the rules are turned off at the moment and we have SP1 Beta loaded.

yes keep us informed.. it is a ginormous task to test sip alg logic behind all possible fw so any feedback will be greatly appreciated.

 

[nb]

The 'Detecting SIP ALG' test fails with a Cisco Meraki MX80.

Cisco device.. Sometimes you need to turn it ON and it is for the world OFF. And OFF is for the world ON.. It is strange but I have seen devices do sip transformations with the sip alg option off!!! Weird but true..

Do you have sip alg on and the 3CX Checker did not detect it? Maybe it gets enabled only when you make a call. Prove it is on and doing transformations by capturing a call. Maybe it is on and it does nothing.,. I have seen cases like this also.

 

[nb]

The test fails with cloud servers hosted by OVH too.

This should work. Maybe you have port issues in the first place. this has to work so you have something either in the ovh configuration or something else in the network.

 

[Tim H]

Running C3X 15.5.5 behind at Cisco SA540 Security Appliance and although I have the firewall configured and SIP ALG Off, I cannot get the firewall test to pass.

I did try the SIP ALG enabled and disabled and it fails both way.

Any help or thoughts appreciated.

 

[Frick]

The SIP ALG is failing on my Sophos XG firewall. I have the SIP Helper on the firewall disabled and do not have any audio issues (I do if I enable the SIP Helper), so I am assuming it is a false positive.

 

[Paul Mul]

Upgraded to 3CX 15.5.5 behind a Draytek 2860 Firewall/Router. Detecting SIP ALG Failed when running Firewall Test. I can confirm that the Firewall Test passed before I performed the upgrade.

I tried the same on a new install in a new site with the same results (Detecting SIP ALG Failed)

Any advise helpful.

 

[YiannisH_3CX]

Please try again now and see if that works now. There was an issue with the servers services and it is now resolved

 

[gulib]

It works correctly now. Shows "Not Detected" on google compute engine. thnk you.