topic Re: 3CX Phone System behind 1450 Appliance in Spark Firewall (SMB)

3CX Phone System behind 1450 Appliance

obaghishvili — Mon, 18 Jan 2021 20:09:05 GMT

Hello

Has anybody ever made 3CXPhone System work behind 1450 Appliance.

I tried probably billion of options found here or over the internet but 3CX firewall checker fails every time.

ports used by 3CX

SIP: TCP 5060-5061, UDP 5060

Tunnel: TCP 5090-5091, UDP 5090

RPT/WebRTC: UDP 9000-10999

WebUI: TCP 5000-5001

Server VoIP3CX services are added and set to manual access policy.

Outbound Policy: Traffic from Voip3CX (server) o the internet of any application is accepted

Inbound Policy: Traffic from any course to This Gateway on Voip3CX (services) is accepted

Manual NAT: Translate traffic from any source to this gateway on Voip3CX (services) as if the traffic is from original source to VoIP3CX (server) on original service

Everything I could get configured is 5000-5001 (to reach the web interface from outside)

Other things do not work.

Phone System firewall checker says (briefly) :

- bla bla
- detecting SIP ALG... not detecteda
- testing port 5060... Mapping does not match 5060. Mapping is 20112.
- testing port 5090... Mapping does not match 5090. Mapping is 20116.
- testing ports [9000..9398]... failed
  - testing port 9000... Mapping does not match 9000. Mapping is 20119.
  - testing port 9002... Mapping does not match 9002. Mapping is 20120.
  - testing port 9004... Mapping does not match 9004. Mapping is 20121.
  - testing port 9006... Mapping does not match 9006. Mapping is 20122.

and so on down to port 10999

I'm advanced with 3CX but pretty new to checkpoint. So any suggestion would be appreciated

Re: 3CX Phone System behind 1450 Appliance

_Val_ — Tue, 19 Jan 2021 11:24:28 GMT

what is in the logs when mapping fails?

Re: 3CX Phone System behind 1450 Appliance

obaghishvili — Tue, 19 Jan 2021 16:14:06 GMT

Which log? check point or 3CX

Re: 3CX Phone System behind 1450 Appliance

G_W_Albrecht — Tue, 19 Jan 2021 19:07:52 GMT

I would assume: both. 8) Did you look at VoIP Issue and SMB Appliance (600/1000/1200/1400) already ? BAsic is sk113573: How to configure VoIP on Locally Managed 600 / 700 / 910 / 1100 / 1200R / 1400 appliances, this is the most important source for a working configuration of VoIP on SMB Appliances.

Re: 3CX Phone System behind 1450 Appliance

the_rock — Tue, 19 Jan 2021 19:16:23 GMT

Can you send us both logs? Also, maybe on CP firewall while testing, do command fw ctl zdebug + drop | grep x.x.x.x (just make sure you test correct IP). It would be helpful to see if anything is getting dropped on kernel level.

Andy

Re: 3CX Phone System behind 1450 Appliance

Vladimir — Tue, 19 Jan 2021 19:26:56 GMT

From your post, it looks like you have defined the Manual NAT for the Inbound portion only.

In this case, for the outbound traffic, 3CX will likely use dynamic port assignments and thus showing you the mismatched mapping.

Check if you can define Manual outbound NAT for original 3CX services.

Re: 3CX Phone System behind 1450 Appliance

obaghishvili — Wed, 20 Jan 2021 08:49:54 GMT

Thanks for reply

added manual rule as

translate traffic from VoIP3CX (server) to External IP on Voip3CX (services) as if the traffic is from original source to VoIP3CX (server) on original service

nothing changed.

Re: 3CX Phone System behind 1450 Appliance

G_W_Albrecht — Wed, 20 Jan 2021 08:51:49 GMT

TAC should be able to resolve that in short RAS very quickly!

Re: 3CX Phone System behind 1450 Appliance

obaghishvili — Wed, 20 Jan 2021 10:57:52 GMT

I already checked guides and suggestions. Opened ticket and talked to supports. They also dont know.

There is nothing blocked or dropped. Logs show that at least 5060 is accepted by CP.

The problem is that original ports ie 5060-5061,5090-5091,9000-10999 are replaced by random ports.

I there any way to FORCE cp use original ports, without enabling deep inspection?

Re: 3CX Phone System behind 1450 Appliance

_Val_ — Wed, 20 Jan 2021 10:57:32 GMT

With manual static NAT, that should not happen. Are you sure you use SIP and not just ANY service in the rulebase?

Re: 3CX Phone System behind 1450 Appliance

obaghishvili — Wed, 20 Jan 2021 19:21:03 GMT

eemmm what?

Re: 3CX Phone System behind 1450 Appliance

_Val_ — Wed, 20 Jan 2021 12:30:34 GMT

He means, technical assistance should be able to help you with a short remote session. In other words, please open a support case for this.

Re: 3CX Phone System behind 1450 Appliance

obaghishvili — Wed, 20 Jan 2021 15:10:55 GMT

ah ) Already did. Spent over 4 hours in zoom with technician. No result. The ticket is still open.

Re: 3CX Phone System behind 1450 Appliance

Vladimir — Wed, 20 Jan 2021 17:49:18 GMT

If you have all 3CX services used in a single NAT rule as a composite group, please try following:

Create individual NAT rules each containing a single defined service and test again.

Re: 3CX Phone System behind 1450 Appliance

Jason_Elmore1 — Wed, 20 Jan 2021 21:12:46 GMT

Don't know if this could be related, but I had trouble getting a VoIP phone provided by a third party working on our network, connecting out through our firewall.

They asked for TCP/5061, which I added the service "sip_tls_authentication".

It never worked.

I found there was also a service "sip_tls_not_inspected", once I added that it worked, both are port 5061.

Not sure what the differences are other than one has a protocol associated with it the other didn't.

Jason

Re: 3CX Phone System behind 1450 Appliance

the_rock — Wed, 20 Jan 2021 23:01:13 GMT

There is your key word "NOT INSPECTED"...that would totally explained why it worked. Technically, any service where protocol is set to "none" would not be inspected by anything or for anything. So, thats the main difference...NOT inspected. Think hard if thats what you want to use...

Re: 3CX Phone System behind 1450 Appliance

obaghishvili — Thu, 21 Jan 2021 07:10:07 GMT

Dude!!!

It was NOT set to ANY, but your words pushed me in right direction.

Here's config that did a magic. WAN IP in static NAT. Hide outgoing traffic and Force translate. Access from all and properly configured Policy.

All tests passed green.

Re: 3CX Phone System behind 1450 Appliance

_Val_ — Thu, 21 Jan 2021 07:53:31 GMT

I am glad it works for you now.

Re: 3CX Phone System behind 1450 Appliance

GTurner04 — Fri, 17 Jun 2022 16:13:39 GMT

I have a 1550 instead of a 1450 and I am not able to find the dialogue box he showed below. Where do I prevent the firewall from changing the ports on the way back?