Unable to activate the licence

[panda33]

Hello,

I've installed a 3CX a few months ago on a local server of a customer without any problem. I am moving the entire 3CX installation to Online.net datacenter in order that it works better (the ADSL line of the customer is not perfectly stable).

I obviously did a backup / restore on the new server Online.net but impossible to activate the license. I have the error message:
<code>3CX failed to establish a TCP connection to activation.3cx.com.
Ensure that the local or border firewalls are configured to allow outbound traffic to activation.3cx.com</code>

I looked into the 3CX forum on several topics, it's written to put in place as primary DNS on the Google's one : 8.8.8.8 and to restart the service configuration of 3CX. It does not work.

After several network tests (ping, MTR etc.), I opened a ticket at Online.net to see where it's stuck. The lock is not in the Online.net place, I can reach an OVH router located in Roubaix and then it blocks. I called OVH France and they asked me to call OVH Ireland (The activation IP 3CX 151.80.125.88 being managed by them ...), for them the lock is higher. So I think there is a lock of the IP of my client's server on the firewall at the 3CX server. I specify that I have another 3XC at Online.net (but in a different datacenter) and I have never had any difficulties to make the activation process. I see it for example by going to the browser on https://activation.3cx.com/, on several servers I can access the web server while on the server of my client I have a timeout.

Could a 3CX administrator help me solve this problem?

My server is a Windows 2016 Standard. On the other 2016 where it's work like a charm, the DNS are those from Online.net without any problems.

Thank you.

Alex.

 

[eddv123]

Hi Alex,

I would always note (And I am sure this is the same for OVH as AWS which I use) that the platform itself may also have it's own ACL rules (called security group in AWS).

These would also require configuring on the platform itself to allow traffic. Worth a check.

 

[panda33]

Hi Alex,

I would always note (And I am sure this is the same for OVH as AWS which I use) that the platform itself may also have it's own ACL rules (called security group in AWS).

These would also require configuring on the platform itself to allow traffic. Worth a check.

Hello eddv123,

Thanks for your help! As requested few weeks ago, we put the server in rescue mode, that me we start the server with a Linux Live CD in order to do some ping, MTR test. The result was the same. On the server even I desactive (the time of the test) the Firewall, there is no answer and the connection goes in timeout without reaching https://activation.3cx.com/ or https://erp.3cx.com/.

 

[eddv123]

In this case it would either be a network related issue (VLAN blocking, network not internet facing - requirement of proxy) or something like that, or more specifically firewall.

Most firewalls are stateful and will allow outbound traffic by default, however some (like Cisco) will require ports to be open both ways.

The issue also could be related to DNS resolution. A trace route to one of these addresses from the server could give an indication of where the issue lies.

 

[panda33]

I've made this kind of test with Online.net and OVH they told me that the lock look to be in the 3CX infrastructure.

There is no VLAN, no proxies or something like that. The both server (same configuration) are in two separate datacenter. But it's the same provider (Online.net). On 1 server it's working without issues but not on the second one.

I can for example reach https://erp.3cx.com on the 1st one but not on the 2nd.

The configuration on both server is the same (firewall, IP v4 et V6 activated etc.), no tweaks nothing.

This week-end I wishes to buy a support ticket but the 3CX shop is not working .

 

[panda33]

I've just reach to create a support ticket with 3CX team. Will see what is going on and update this thread.

 

[eddv123]

If you can add anything to the string from the ticket it would be useful.

To confirm you do have Windows firewall turned off on the server?

 

[panda33]

Yes even the firewall on or off, it's not working. So I guess it's blocked on the 3CX side!

 

[panda33]

After a lot of investigation...

The problem seem to be on a blacklist on 3CX network. After a lot of exchange between them and me, they keep continuing to deny the problem.

All has been tested from my network to them, with or without firewall, the network engineer from the Datacenter (Online.net) helped me a lot (thanks to them!) and still not working !

So, I've installed the server in a virtual environnement, on the SAME server, with the SAME configuration (firewall etc). The only thing that is different is the IP address and it's working...

If you have the same problem than me, and DNS server change doens't resolve your problem, try a different IP if you can like me.

For my problem, I've used a failover IP to bind to my virtual machine.

Now all is working fine but I've pay a 75 € ticket for NOTHING !

 

[mixig]

Same thing with my two customers last few days, both 3cx on debian 9, 3cx is on SP4.
Telnet to activation.3cx.com by port 443 is ok, connection is established, i see traffic on my router in both direction but error is the same.
I canot put different IP for test purpose, next step is wireshark to see exact what is coming from 3cx license server to 3cx PBX

 

[Saqqara]

You need to upgrade to 15.5 SP6 for activation to work

 

[mixig]

Thanks Saqqara you are right, i went to artical for SP6 again and it says:

SSL Security Updates
In the next month we will be updating the security certificates on our servers, required for secure communication with 3CX. This means that you will need to go to update 6 as soon as possible. We continue to add many security features under the hood to ensure safe operation of the PBX and secure communications.

 

[panda33]

The 75 € ticket was useless. The person continue always to repeat like a parrot that my configuration was the cause of the problem... I've duplicate all the machine to a virtual machine. So all is exactly the same exept the IP address and with a different one, I was able to activate the server.