V16 Update 2 is Out with New SBC and Improved Website Chat

[InfotechUK]

@InfotechUK
If you use non-standard SIP port for SBC, you have to locate 3cxsbc.conf.local, find #LocalSipPort there, uncomment it (remove #) and put the needed port. Save and restart the SBC.
Feel free to send me a message if you need more info.

Thanks for the reply. LocalSipPort surely will allow anything? When I say non default ports I mean on the pbx, as we saw huge amount of attacks. Since changing we see zero.

I have re-installed 3cxsbcv15 again but its still not working. If I run the new installer then I will not take the auth keys or passwords that are generated by the pbx. I feel like I'm digging the hole deeper...

 

[bp1]

@NickD_3CX @Nick Galea I could not find it in the release notes, but we upgraded from 16.0 (initial production release) to update 2 in order to deploy the new SBC. All of a sudden our t.38 over IPSec FXS g/w (still sub-40ms) are having enormous fail rates they were not experiencing on the previous build. The local t.38 g/ws aren't having any troubles (sub-5ms). Initial packet captures indicate a BYE mid-transmission. We've bypassed the PBX and registered the G/W (grand stream HT801s) direct with sip.us and we send/receive without issue. What changed w/ t.38 FXS in update 2?

 

[StefanW]

are we talking about
-a VPN of IP sec
or
- 3CX SBC over which you route FXS gateways to 3CX?

 

[bp1]

are we talking about
-a VPN of IP sec
or
- 3CX SBC over which you route FXS gateways to 3CX?

We have the FXS routed over IPSec. I was told the FXS wouldn't route over the SBC. We do have SBCs in those locations but also have IPSec solely for the faxes.

 

[StefanW]

Okey, just making sure as the SBC is not mode/tested/optimized for T.38 transmission.

T.38 Processing has nothing changed has no changes since the release of v16.
So the subject must be coincidental.

 

[bp1]

It only happens on intra-PBX t.38 streams. When registered ATAs fax out to POTS and back in, the faxes appear to complete without issue.

 

[NickD_3CX]

Thanks for the reply. LocalSipPort surely will allow anything? When I say non default ports I mean on the pbx, as we saw huge amount of attacks. Since changing we see zero.

I have re-installed 3cxsbcv15 again but its still not working. If I run the new installer then I will not take the auth keys or passwords that are generated by the pbx. I feel like I'm digging the hole deeper...

The lack of standard ports is not a problem at all. The configuration file that the 3CX SBC downloads contains all this information.
You haven't given us though a lot of information about what problem you are having. The only thing I can tell is that is has nothing to do with the new version of the software, because re-installing the older version still leaves you with issues.

Make sure you are on V16 Update 2. Try installing the new SBC. During the installation, it asks for the Web URL and Key. Does the installation tell you that it was successful or does it tell you that it couldn't reach the server?
Also, in the /etc/resolv.conf you should see some IPs of nameservers. Are they all valid?

 

[InfotechUK]

The lack of standard ports is not a problem at all. The configuration file that the 3CX SBC downloads contains all this information.
You haven't given us though a lot of information about what problem you are having. The only thing I can tell is that is has nothing to do with the new version of the software, because re-installing the older version still leaves you with issues.

Make sure you are on V16 Update 2. Try installing the new SBC. During the installation, it asks for the Web URL and Key. Does the installation tell you that it was successful or does it tell you that it couldn't reach the server?
Also, in the /etc/resolv.conf you should see some IPs of nameservers. Are they all valid?

I have updated the pbx to 16.0.2.910 and installed the latest SBC version. The install of the SBC was successful and I can see the connection now under >SIP Trunks (its green). All looks ok from that point.

Now I'm back where I started with the original issue. None of my phones now show in menu >Phones in the MC. I've factory defaulted one of the phones and it doesn't show either.The tunnel looks like its connected.

The pbx is hosted. I have checked the resolv.conf and it had two nameservers that were the routers default, so I added more... Ping/Traceroute works fine.

Obviously this all worked perfectly well before the update so the original config of the system was ok.

 

[NickD_3CX]

I have updated the pbx to 16.0.2.910 and installed the latest SBC version. The install of the SBC was successful and I can see the connection now under >SIP Trunks (its green). All looks ok from that point.

Now I'm back where I started with the original issue. None of my phones now show in menu >Phones in the MC. I've factory defaulted one of the phones and it doesn't show either.The tunnel looks like its connected.

The pbx is hosted. I have checked the resolv.conf and it had two nameservers that were the routers default, so I added more... Ping/Traceroute works fine.

Obviously this all worked perfectly well before the update so the original config of the system was ok.

The first thing I would check as a Factory Reset does not result in the IP Phone showing up in the MC is if the Multicast message the phone is sending is reaching the SBC.
So, are the IP Phones and the SBC on the same Subnet/LAN? How many NICs does the SBC have? If all this checks out, you could start a packet capture on the SBC, Factory Reset the phone again, wait until it boots. If it doesn't show up again, open the packet capture in Wireshark and use a filter like "ip.addr==<IP of Phone>" and see if it sent a packet with target of 224.0.1.75 port 5060.

If it was working at some point, I'll leave these points last, but they are still important. Are the phone supported and on the latest/correct firmware?

 

[InfotechUK]

The lack of standard ports is not a problem at all. The configuration file that the 3CX SBC downloads contains all this information.
You haven't given us though a lot of information about what problem you are having. The only thing I can tell is that is has nothing to do with the new version of the software, because re-installing the older version still leaves you with issues.

Make sure you are on V16 Update 2. Try installing the new SBC. During the installation, it asks for the Web URL and Key. Does the installation tell you that it was successful or does it tell you that it couldn't reach the server?
Also, in the /etc/resolv.conf you should see some IPs of nameservers. Are they all valid?

Thanks Nick but it turns out

The lack of standard ports is not a problem at all.

Was indeed a problem.... Its sorted now. The updates seem to assume or override custom config. Using 5060 on a hosted server is bonkers IMHO. You are asking for trouble and from my experience you get plenty (trouble). Changing default ports should be security 101 for anybody wanting to implement a solution like voip.

 

[NickD_3CX]

Thanks Nick but it turns out
Was indeed a problem.... Its sorted now. The updates seem to assume or override custom config. Using 5060 on a hosted server is bonkers IMHO. You are asking for trouble and from my experience you get plenty (trouble). Changing default ports should be security 101 for anybody wanting to implement a solution like voip.

I'm glad to hear that its sorted it now. I'll check what you are saying about the non-standard ports, although I distinctly remember testing this myself also.
Just to be clear, we are talking about installing the 3CX Server with non-standard ports, e.g. 6060 and 6090 right?

 

[bp1]

It only happens on intra-PBX t.38 streams. When registered ATAs fax out to POTS and back in, the faxes appear to complete without issue.

@StefanW @Nick Galea @NickD_3CX I actually stated this backward. It's the internal faxes we see completing via t.38. When an external fax goes through after the update, the carrier is not seeing the t.38 re-invite so all faxes are attempting to complete via g.711 - which has an almost 0% completion rate for IPSec FXS gateways. I read where having "G.711 fallback to t.38 [BETA]" deselected (and a subsequent IVR service restart) would cause the t.38 re-invite to be sent immediately instead of waiting 10 seconds, but we are still not seeing t.38 as an option for external faxes. We have verified with the carrier that t.38 is selected at their PSTN interface switch and trunk. We also felt like it was a coincidence, but the t.38 streams were working prior to the upgrade. Supports reinvite/replace and PBX delivers audio are all selected (and have been all along) on the trunk.

We're scrambling to get this working again after several days' outage so we're currently spinning up trial trunks with approved cloud-based SIP providers that state they'll support t.38. We did this earlier with sip.us but put in a ticket to find out they REALLY don't support t.38 but push a slick t.37 fax over https with an AudioCodes ATA you have to order. We really don't care to re-deploy something that was working prior with another USD150+ setup, but they guarantee it'll work. Should know more in a few hours as we'll have babyTel, flowroute, United, twilio, Broadvoice, and/or bandwidth.com test trunks up. I'm expecting within the first few additional trunks we'll start seeing some results either way.

 

[bp1]

Added babyTel and it was still sending only G711. Honestly, we're not 100% sure what changed, but we started seeing t.38 re-invites later this afternoon on all carriers. All we have logged in our change management log is the disabling and re-enabling of g.711 fallback to t.38 (with the IVR restart). We have verbose logging enabled is that's even worth exporting for reference.

 

[NickD_3CX]

Added babyTel and it was still sending only G711. Honestly, we're not 100% sure what changed, but we started seeing t.38 re-invites later this afternoon on all carriers. All we have logged in our change management log is the disabling and re-enabling of g.711 fallback to t.38 (with the IVR restart). We have verbose logging enabled is that's even worth exporting for reference.

I am not sure how this option helped in your situation, because this option is for the built-in Fax Server, it shouldn't affect any FXS devices that are registered with Fax Extensions.
Note that if you do have an FXS device and you have fax device on one of the analog ports, the port must be configured as a Fax Extension in 3CX.

 

[bp1]

I am not sure how this option helped in your situation, because this option is for the built-in Fax Server, it shouldn't affect any FXS devices that are registered with Fax Extensions.
Note that if you do have an FXS device and you have fax device on one of the analog ports, the port must be configured as a Fax Extension in 3CX.

They are all config'd as fax extensions w/FXSes. I know it doesn't make sense which is why I mentioned the verbose logging, but I'm 100% certain no ATAs were re-provisioned between t.38 working and not working.

 

[orange2]

Is there a suggested way to upgrade the Win SBC to .latest please?

 

[ivank]

Is there a suggested way to upgrade the Win SBC to .latest please?

You have to reinstall it, unfortunately. But after that it will be controlled from inside the Management Console.