VPN Through Gateway/router, or Phones?

[Jimstigator]

Hey there,

Looking to optimize my first 3CX implementation. Given the scenario below, would my best bet be to configure the phones as a local device, or use the builtin remote/VPN option in 3CX/on the phones, or go with the existing VPN tunnels between gateway/routers?

Call quality is currently ok, but could probably still improve a bit. Have a few registration issues on some phones. They register/unregister over and over. It's hard to predict, and doesn't happen daily.

Setup:
-Phone server at site 1 (hosted), no phones here. ".5" subnet.
-50 phones 100 miles away at site 2. All Yealink VP530. ".3" subnet.
-15 phones 100 miles away at site 3. Yealink VP530. ".6" subnet
-3 phones 100 miles away at site 4. Yealink T38. ".7" subnet
-3 phones 100 miles away at site 5. Yealink T38. ".8" subnet
-Remote sites tunnel to both the main remote site ".3", and the hosted site, ".5".

Thanks!
Jim

 

[3CXfoxhallsolutions]

Hi Jim
I think this crosses with your other thread - but - there are advantages in connecting your remote phones back to the 3CX via VPN:

- First they appear as routed IP addresses in the 'Phone' management page of the 3CX Management app' - and therefore, they can be selected and edited. If they are on remote public IP's, you can't access them this way.

- and second, they can be reprovisioned easily via the VPN - again through the 'Phones' management page (select the phone and use the 'Reprovision phone' button.

Best regards ...

 

[netswork]

What is the bandwidth between locations and what devices are you using for the VPN tunnel?

 

[infonetics]

We use hardware IPSec VPN tunnels almost exclusively, the only exception is for mobile users, then we will typically use the WAN IP for phones, or use a client-side VPN for accessing other network resources. Cisco small business routers here.

 

[sigma1]

If you opt for a VPN approach you will end up with a PBX delivers audio ONLY and an incredible waste of bandwidth. Sure there are advantages BUT in my opinion it is not the ideal configuration for your layout.

You needed to specify:
PRI or SIP trunks? If PRI or pots, are the gateways distributed or at the server location only?

 

[infonetics]

How would a VPN result in PBX Delivers Audio only? The endpoint is technically within the same LAN as the PSTN Gateway (in our case), or SIP provider registration, so I don't see why it would have to run endpoint-PBX-endpoint.

In the case of my home office, my PBX is at the office at 192.168.1.50, my Patton Gateway is at 192.168.1.30, my home phone is at 192.168.2.201. IPSec VPN tunnel means that I'm essentially in the same network as if I were at the office. So once the call is setup, I should be running straight from 192.168.2.201 --> 192.168.1.30.

Unless you're referring to using VPN client within phone only. In that case, disregard...

 

[sigma1]

Infonetics, I assume that you are new at this. If you are using a SIP trunk, you are forcing Trunk EP to PBX to Phone rather than Trunk EP to Phone.