Using random high ports issue

[Jeff.H]

I have one site that is in an executive suite building that also provides internet and firewall for all customers in the building. They are using random high ports on the traffic coming from the equipment there and I cannot get phones to register because of the PAT not sending the requests out on the normal 5060 etc ports. How can I configure my hosted pbx to operate on those nonstandard ports?

 

[SteveITS]

Are they using an SBC? That ought to simply setup. If using STUN ports will need to be forwarded to the phones...

 

[Jeff.H]

Are they using an SBC? That ought to simply setup. If using STUN ports will need to be forwarded to the phones...

3CX hosted has an SBC that I have no control over. I have this site on a version of Incredible PBX that works just fine with random high ports as I am able to whitelist the static source IP in my firewall rules. I seem to have lost that ability by moving to hosted 3CX. I have whitelisted the IP in the hosted PBX itself, but the PBX does not seem to want to operate on the random high ports.

 

[AndreasY_3CX]

Hi,

I am afraid the usual and recommended way to connect IP phones to your 3CX hosted instance is by using SBC.

Surely, 3CX hosted instances have restrictions in order to avoid networking issues and ensure reliability of the system.

 

[Jeff.H]

Hi,

I am afraid the usual and recommended way to connect IP phones to your 3CX hosted instance is by using SBC.

Surely, 3CX hosted instances have restrictions in order to avoid networking issues and ensure reliability of the system.

Unfortunately that is not helpful nor relevant to my question. I am using Hosted 3CX in which you provide the SBC. There is also no mention of having to use the standard ports in that documentation.

 

[AndreasY_3CX]

If you're asking which ports are used within a 3CX system, you can check out the following link: https://www.3cx.com/docs/ports/

 

[Jeff.H]

If you're asking which ports are used within a 3CX system, you can check out the following link: https://www.3cx.com/docs/ports/

That is not my question. I have a site that has no control over the port address translation of traffic that is outbound from their building. That PAT results in traffic being sent out on random high ports. I know what the standard ports are. I would like to know how to have the random high ports accepted by the 3CX Hosted PBX. If that is not possible then I will find another platform to support.

 

[Saqqara]

Unfortunately that is not helpful nor relevant to my question. I am using Hosted 3CX in which you provide the SBC. There is also no mention of having to use the standard ports in that documentation.

confused by the statement, 3cx does not provide the sbc

you have to install a sbc server at the location of the phones https://www.3cx.com/docs/3cx-tunnel-session-border-controller/

installing a sbc server, no firewall port forwarding is require - just requires 3cx tunnel (tcp / udp 5090) and https port out.

when the sbc is registered , you factory default the phones and assign them to the extension

 

[SteveITS]

Are you trying to control the source port for the SBC device on the LAN to connect out to the hosted 3CX server? Normally source ports for an outgoing connection are randomized. The 3CX server should not be blocking the SBC connecting to it (why do you think it is?). If the building firewall has to be set to allow outbound connections (rare) it can be set to allow from your SBC's LAN IP address out to the 3CX server IP.

 

[NikosT_3CX]

@Jeff.H I think there is a confusion here, lets put things in order.
One side is the hosted by 3CX PBX which uses the standard ports and these can not change.
Now, if you are trying to setup STUN phones, this is not supported for Hosted by 3CX and since you dont have control of the office firewall this will not work since no port forwarding can be done.
Yes source ports of the phones or the requests that leave from your office have random ports and PBX of course accepts this.
SBC on local site will help you avoid port forwarding issues, will encrypt the traffic to the PBX and your deskphones will speak with the PBX via the SBC and you will have zero issues.
So this mean you will have to install the SBC on site ( as per link above ) , its not an online service we provide.
Does this make things more clear for you ?

 

[Jeff.H]

Are you trying to control the source port for the SBC device on the LAN to connect out to the hosted 3CX server? Normally source ports for an outgoing connection are randomized. The 3CX server should not be blocking the SBC connecting to it (why do you think it is?). If the building firewall has to be set to allow outbound connections (rare) it can be set to allow from your SBC's LAN IP address out to the 3CX server IP.

The building is allowing the outbound traffic and I see it register on the Incredible PBX on port 59351 as shown in the screenshot. I also see it get blacklisted for failed reg attempts when I point it to the 3CX PBX. I have three other sties that I migrated from Incredible to 3CX without issue and do not use an SBC at any of them. I have verified all the settings in the phones are the same except the obvious differences in SIP server and unique extension settings. I have pointed a phone from this site to the other 3CX PBXs and its the same result everywhere. The only thing that is different is the port being used for SIP registration is not 5060 from this one site.

 

[Saqqara]

As you do not have access to the firewall to setup the 3cx recommended setup for stun phone

You have to install a SBC server, for the system to work in this instance

 

[SteveITS]

Jeff, your 3CX server is "hosted by 3CX" correct? If so STUN is not supported and installing an SBC is required.

How exactly are you setting up the phone for 3CX when you say, "point it to the 3CX PBX?" Factory reset and STUN (with fixed IP and port forwards, which as noted isn't supported with "hosted by 3CX")?

You can add the client's office IP to the "IP Blacklist" list as Allow so their office doesn't get blacklisted by the 3CX server.