" Full cone NAT" + VOIP ?

[#1]

We are evaluation the 3CX VOIP Software Based PBX which on the whole is working well apart from incoming calls where we seem to have a firewall issue. The firewall is a Fortigate 60B and the VOIP system resides on an internal IP of 172.16.1.21. Our provider has stated that :

The following ports need to be open: 
  
 5060 TCP & UDP 
 10000 – 20000 UDP

However in the 3CX system you can restrict the number of ports being used, for testing I set this to 9000 to 9001 UDP. The firewall test fails with : 1 9000 Error (4) The STUN server returned an ip which is not accessible from outside. addrFromSTUN = 84.45.179.66:55492 2 9000 Error (6) An incompatible NAT configuration has been detected. Please check FAQ for further information. addrFromAgent = 84.45.179.66:55494addrFromSTUN = 84.45.179.66:55492 3 9000 Warning (8) Local port is not blocked from outside. STUN server has returned global port different from the local one, but the local port is also accessible from outside. 4 9000 Error (10) Port is open, but port number has been changed during NAT translation. THIS ERROR means you have Symmetric NAT and you do not have STATIC PORT MAPPINGS in place. 3CX Phone System will not communicated correctly with your VOIP provider or external extensions. See this FAQ: http://www.3cx.com/support/firewal-checker.html externalAddress = 84.45.179.66:55492 The solution from 3CX was to upgrade to a better firewall such as a Draytek(!) The solution appears to be to use " Full Cone NAT" or basically a Virtual IP to forward all the ports from a given external IP address to the LAN address 172.16.1.21. The problem I have is the external address 84.45.179.66 is being used for a SMTP VIP as well. Is there anyway to make traffic from a given internal IP (172.16.1.21) to go out via a different external IP address ? All my interfaces are currently in use and the WAN1 is the only interface on the 84.45.179.X network. Or do I have to move my DNS entries for e-mail ? Hope this makes some sense.

[#2]

Well I' ve actually got it working. I' ve moved all my VIP' s away from the WAN1 IP address and put a Static NAT entry on there to the Phone System. Doesn' t explain why the phone system wouldn' t go out using the IP POOL but it' s working now so I' ll stick with it. Thanks everyone for all your help was appreciated.

[#3]

Yeah it works a treat can wholly recommend it. You can have a full 10 extension VOIP PBX system for less then £3000 including handsets. The flexibility is amazing, remote workers who can have an internal extension half way round the world anyone ? I think the Phone System connects into to the VOIP provider on a regular basis keeping the connection alive. Right I' m off to work out how to implement a PBX to SkyPE connector now!

[laf]

Now that everything works fine, could you posts the firewall configuration again, only the rules you re using. And if possible, not graphical, just the CLI configuration ;)

[#5]

Yes of course. This scenario is a VOIP PBX Phone system behind a Fortigate firewall working in NAT/Route mode. The VOIP PBX Phone system utilises an external VOIP Provider proxy to route incoming and outgoing phone calls via SIP. The external IP address of the firewall is 99.99.99.99 and the internal IP address of the PBX Server is 192.168.1.1. Requirement to getting this working : The external IP address of the firewall has no VIP' s on it. The IP address you go out on needs to be to be clear of any VIPs, I had to move my SMTP/Webmail up an IP address.

 config firewall profile
     edit " SIP" 
         set log-voip enable
         set ftp splice
         unset http
         unset https
         set imap fragmail spamfssubmit
         set pop3 fragmail spamfssubmit
         set smtp fragmail spamfssubmit splice
         set pop3-spamtagtype subject
         set nntp no-content-summary
         unset im
             config sip
                 set status enable
                 set invite-rate 10
                 set nat-trace disable
                 set register-rate 10
             end
         set ftgd-wf-options strict-blocking
         set ftgd-wf-https-options strict-blocking
     next
 end
 config firewall vip
     edit " SIP" 
         set extip 99.99.99.99
         set extintf " wan1" 
         set mappedip 192.168.1.1
     next
 config firewall policy
     edit XX
         set srcintf " wan1" 
         set dstintf " internal" 
             set srcaddr " all"              
             set dstaddr " SIP"              
         set action accept
         set schedule " always" 
             set service " SIP"              
         set profile-status enable
         set profile " SIP" 
     next
 end
 

Search : 3CX VOIP SIP PBX

[#6]

Hi there All i am trying to setup our VoIP system at our offices. We are also using 3CX. The problem i am having is when i do the firewall test, it returns with error 15. i think the problem is our external address, we do not have static ip for the external but i dynamic, like a dyndns. Would this cause the problem? or will it work on a dyndns address? See when i setup i VIP, the external adress i leave as 0.0.0.0 as we dont have one... Your help is always appreciated. Thanks

[jhobson]

FYI still testing the MR patches, but it would appear that FortOS v3.0 MR6 works with 3CX firewall, however the v3.0 MR7 release does not work with 3CX, with inbound calls failing.

[#8]

Hi Justin, Can confirm the above is working with MR7 726 build on a 60B.Also you don' t need to forward everything to the internal IP of the 3CX : 60B running MR7(726) build. Scenario is 3CX is on an internal address behind the firewall running in NAT mode. Firewall -> Protection Profile -> Create New Call it SIP or something Expand VOIP check SIP and se both fields to a number (we picked 10). Firewall -> Virtual IP -> Create New Call it something i.e. VOIP_INCOMING Static NAT External IP Address : x.x.x.x (Put your external IP in here) Internal IP Address : 192.168.1.X (or whatever your 3CX server is on) Port Forwarding UDP 5060 5060 Firewall -> Policy -> New Source WAN1 Destination VOIP_INCOMING Service SIP Protection Profile SIP Leave NAT unchecked.