3CX SIP traffic and NAT

[mundasos]

Hi Guys

I have set up 3CX behind my 200B but can't get calls to work with NAT enabled. I have disabled SIP helper etc. by following the below:

"config system settings set sip-helper disable set sip-nat-trace disable

config system session-helper show //locate the SIP entry, usually 12, but can vary. delete 12 //or the number that you identified from the previous command.

config voip profile edit default config sip set rtp disable

config system settings set default-voip-alg-mode kernel-helper based end

reboot the device or clear sessions"

Calls only work if I disable NAT on the WAN > LAN policy (otherwise I get one way audio or can't even pick up the call). The problem is 3CX requires NAT for all the services to work properly so when I run firewall checker on 3CX it errors with "full cone NAT failed".

Would appreciate any ideas.

thanks

[mundasos]

Just to add I have VIP on the WAN > LAN policy which according to my research is suppossed to take care of one to one NAT both ways, right? Anyway it doesn't make a difference if I configure LAN > WAN with IP pool...

No one uses 3CX here?

[sdb_tobbe]

Hi , you need to have fixed port on outgoing interface.

Make a rule with the specified host for outgoing traffic and enable fixed port. If you are running older firmware you need to enable fixed port via cli.

example:

    edit 452         set srcintf "if_vlan400_int"         set dstintf "if_vlan_550_ext"         set srcaddr "cust_xxxx_3cxsipsrv02"         set dstaddr "all"         set action accept         set schedule "always"         set service "ALL"         set nat enable         set fixedport enable         set ippool enable         set poolname "cust_xxxx_3cxsipsrv02_out"     next

The important word here is "fixedport"

[mundasos]

Is "fixedport" still needed in 5.2 firmware?

Apparently with VIP on inbound policy you don't need IP pools anymore?

thanks

[sdb_tobbe]

Nevermind the ippool, it was just an example cut from a config-file.  As I said, The fixed port is the important thing here.

And yes, fixed port is still needed. If you try "firewall check" in 3cx you will see errors to external STUN-servers without the fixed port enabled.

[mundasos]

thanks but no joy I'm afraid, this is my LAN > WAN policy:

set srcintf "port14"

set dstintf "port13" set srcaddr "3cx" set dstaddr "all" set action accept set schedule "always" set service "ALL" set nat enable set fixedport enable

WAN > LAN

set srcintf "port13" set dstintf "port14" set srcaddr "Voipprovider" set dstaddr "3CX" set action accept set schedule "always" set service "ALL" set logtraffic all

Calls are working but 3CX test still fails with "full cone test failed"...