Try Out the New 3CX SIP ALG - Firewall Check

[3CXDude]

Working now on OVH now too !!

 

[Frick]

Please try again now and see if that works now. There was an issue with the servers services and it is now resolved

This fixed my issue. The firewall check is now passing. Thank you.

 

[Steven Cage]

working on Meraki MX80 now. Thanks

 

[complex1]

If you are interested:
I can confirm that the Draytek 2710n, Draytek 2130n, MicroTik RB2011 and OVH pass the Firewall Check test.

 

[GrahamCM]

As seen by others, the AGL firewall test is now working correctly for me also. Thanks.

[ For reference, the firewall in use is pfSense (v2.2.4) ]

 

[cobaltit]

Works with UniFi USG3. Detected ALG when it was on and passed when it was off.

 

[ajohnson443]

Just installed 3CX Debian, ran the firewall checker and saw the new SIP ALG detection had failed. I logged in to my router and disabled the SIP ALG and re-ran fw checker.. It passes. Glad you added this, I had no idea SIP ALG ws on by default on my router

Router: Cisco 881W

 

[YiannisH_3CX]

Thank you all for your feedback. The more firewalls we test the better the service will be.
Keep it coming

 

[tomnorton]

We have 3CX running behind a PaloAlto PA-3020 Firewall. (PAN-OS 8.0.4). The test was failing, however I discovered SIP ALG was switched on the firewall. I disabled it and the test now passed.

Info on PaloAlto and SIP ALG can be found here: https://www.paloaltonetworks.com/do...disable-the-sip-application-level-gateway-alg

 

[RodSlinger]

Zywall USG50 - Works. It will show the ALG failure when enabled and passes when turned off.

 

[David Beveridge]

I am just setting up a new Debian installation ver 15.5.5 with a mikrotik router.

• • • resolving 'stun-au.3cx.com'... done
    • resolving 'stun2.3cx.com'... done
    • resolving 'stun3.3cx.com'... done
    • resolving 'sip-alg-detector.3cx.com'... done
    • testing 3CX SIP Server... failed (How to resolve?)
      • stopping service... done
      • detecting SIP ALG... failed (How to resolve?)
      • testing port 5060... not reachable (How to resolve?)
      • starting service... done
    • testing 3CX Tunneling Proxy... failed (How to resolve?)
      • stopping service... done
      • testing port 5090... not reachable (How to resolve?)
      • starting service... done
    • testing 3CX Media Server... failed (How to resolve?)
      • stopping service... done
      • testing ports [9000..9255]... failed (How to resolve?)
        • testing port 9000... not reachable (How to resolve?)
        • testing port 9001... not reachable (How to resolve?)
        • testing port 9002... not reachable (How to resolve?)

I'm certain the ports are open. When I try to use telnet on port 5060 from outside, it connects.

 

[complex1]

@David Beveridge,

I'm using a Mikrotik also without issues.
Please go to IP > Firewall Service Ports and disconnect the SIP ALG service and try again.

 

[StefanW]

I am just setting up a new Debian installation ver 15.5.5 with a mikrotik router

We have a very comprehensive guide for those routers: https://www.3cx.com/docs/mikrotik-firewall-configuration/
and an general overview: https://www.3cx.com/docs/manual/firewall-router-configuration/

 

[David Beveridge]

I've read both of those guides and I've disabled the sip alg service.

 

[David Beveridge]

I read somewhere that the tests https://www.ssllabs.com/ssltest/analyze.html should return an A+ and I though I'd give it a go.
I found that the test only allows tests to port 443 and my PBX wasn't listening on that port. So I edited the nginx config file.
I added this line
listen 443 ssl;
above the same line for port 5001.
e.g.
root@pbx:~# vim /var/lib/3cxpbx/Bin/nginx/conf/nginx.conf
root@pbx:~# nginx -t
nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
root@pbx:~# systemctl restart nginx

For some reason, the firewall test now works. Dunno why though.

 

[mic.max]

3CX v15.5 on Windows 2008 R2 server, with cisco router 887VA and sip ALG on router disabled for tcp and udp on 5060 port, TEST ALL OK on firewall check!