my bad... i meant outbound not inbound sometimes does not go through and I will need to redial to get through.
----- Original Message ----- From: "Francis Tinio" <[email protected]> To: "M. Ranganathan" <[email protected]> Cc: "sipx-users" <[email protected]> Sent: Monday, November 2, 2009 11:28:10 AM GMT -05:00 US/Canada Eastern Subject: Re: [sipx-users] sipxecs behind endian firewall I'll post my config after I confirm everything worksas it should. currently calls are a bit choppy and sometimes inbound does not ring, i will need to redial.... question, what codecs are built into sipx? can I use G729, or just G711? ----- Original Message ----- From: "M. Ranganathan" <[email protected]> To: "Francis Tinio" <[email protected]> Cc: "Tony Graziano" <[email protected]>, "sipx-users" <[email protected]> Sent: Monday, November 2, 2009 11:12:11 AM GMT -05:00 US/Canada Eastern Subject: Re: [sipx-users] sipxecs behind endian firewall Good show! Please post your config. I will update the wiki. Ranga On Mon, Nov 2, 2009 at 10:12 AM, Francis Tinio < [email protected] > wrote: WOOOT!!! Got some very good news... GOT IT TO WORK!! I can send and receiv e calls using gafachi for both origination and termination. I'm also using Endian (2.3) as the firewall. By default Endian does not do symmetric as my previous settings showed in gafachi that my box was connecting via some random port. But now it shows that it's receiving from port 5080 as well as sending to 5080. I have also tried doing call transfer to a different extension (both configured in the same laptop, one is Bria the other is XLITE) and the call gets transferred successfully. Only issue I am seeing right now is that if I call from extension to extension, in this case 5002 to 5001, the call goes through but no sound. I'm not sure if it's due to both extensions running in the same laptop with the same audio devices. Coz I cann call to any PSTN and it goes through. I can also receive calls without a hitch! How do I post my config in the wiki so others can use it as reference. Also, I can say gafachi is compatible. ----- Original Message ----- From: "Tony Graziano" < [email protected] > To: [email protected] Sent: Monday, November 2, 2009 6:28:12 AM GMT -05:00 US/Canada Eastern Subject: Re: [sipx-users] sipxecs behind endian firewall There is a list on the wiki page for trunking. I use bandwidth.com . ============================ Tony Graziano, Manager Telephone: 434.984.8430 Fax: 434.984.8431 Email: [email protected] LAN/Telephony/Security and Control Systems Helpdesk: Telephone: 434.984.8426 Fax: 434.984.8427 Helpdesk Contract Customers: http://www.myitdepartment.net/gethelp/ ----- Original Message ----- From: Francis Tinio < [email protected] > To: Tony Graziano < [email protected] > Sent: Sun Nov 01 22:34:05 2009 Subject: Re: [sipx-users] sipxecs behind endian firewall which itsp would you recommend? for origination and termination. i need some NJ/NY DIDs ----- Original Message ----- From: "Tony Graziano" < [email protected] > To: "Michael Picher" < [email protected] > Cc: "Francis Tinio" < [email protected] >, "sipx-users" < [email protected] > Sent: Sunday, November 1, 2009 7:17:48 PM GMT -05:00 US/Canada Eastern Subject: Re: [sipx-users] sipxecs behind endian firewall Yes. Mike's right. This is all in the ITSP trunking setup on the wiki too. The carrier sends to you on port 5080. When your firewall sends it to sipx, there is a software function that changes this to port 5060 so the proxy doesn't care, but it has to be tracked differently from users. Remote users communicate over the standard port of 5060. If your carrier cannot support changing the signalling port for you, run, don't walk, the the wiki ITSP how to page and pick a carrier that is known to work. It will probably mean the one you have is not grown up enough yet. On Sun, Nov 1, 2009 at 6:43 PM, Picher, Michael < [email protected] > wrote: Yes, and yes... Gafachi needs to send to you on 5080. -----Original Message----- From: Francis Tinio [mailto: [email protected] ] Sent: Sunday, November 01, 2009 6:20 PM To: Picher, Michael Cc: sipx-users; Tony Graziano Subject: Re: [sipx-users] sipxecs behind endian firewall I would assume that the 5080 I need to setup in gafachi side right? and for NAT public port? Should I keep it at 5060? ----- Original Message ----- From: "Michael Picher" < [email protected] > To: "Francis Tinio" < [email protected] >, "Tony Graziano" < [email protected] > Cc: "sipx-users" < [email protected] > Sent: Sunday, November 1, 2009 6:17:23 PM GMT -05:00 US/Canada Eastern Subject: RE: [sipx-users] sipxecs behind endian firewall 5080 for inbound SIP trunk to talk to sipxbridge. Leaves 5060 for phones to register. -----Original Message----- From: [email protected] [mailto: [email protected] ] On Behalf Of Francis Tinio Sent: Sunday, November 01, 2009 6:06 PM To: Tony Graziano Cc: sipx-users Subject: Re: [sipx-users] sipxecs behind endian firewall also, I'm getting confused with which ports are which... I thought it's supposed to be 5060 for sip? what is the 5080 for? ----- Original Message ----- From: "Francis Tinio" < [email protected] > To: "Tony Graziano" < [email protected] > Cc: "sipx-users" < [email protected] > Sent: Sunday, November 1, 2009 6:03:56 PM GMT -05:00 US/Canada Eastern Subject: Re: [sipx-users] sipxecs behind endian firewall Thanks! Once I get this working I'll post my complete settings for others as I believe there are others trying to get sipx working with gafachi. For sip settings, they have not specified anything except what's in their asterisk config sample. This is what they require for sip (asterisk conf files, not sure how to translate for sipx): /etc/asterisk/extensions.conf [general] static=yes writeprotect=yes [default] ; NOTE: The line below is required. It will not affect the Calling Name ; from displayed to the called party. If the called party subscribes to ; Calling Name service, the called party's local exchange carrier performs ; a query to determine the Calling Name based on the Calling Number that is ; received with the call. exten => _1NXXNXXXXXX,1,Set(CALLERID(name)=) exten => _1NXXNXXXXXX,2,Dial,SIP/${ext...@gafachi||o exten => _1NXXNXXXXXX,3,Hangup exten => _011.,1,Set(CALLERID(name)=) exten => _011.,2,Dial,SIP/${ext...@gafachi||o exten => _011.,3,Hangup [gafachi-incoming] ; NOTE: this section is for Gafachi Origination (incoming) services. ; DID and/or Toll free origination numbers need to include the "1" prefix ; Replace the 12125551234 with your DID or Toll Free number, and repeat or ; change as needed. exten => 12125551234,1,Dial,Zap/g1 exten => 12125551234,2,Hangup /etc/asterisk/sip.conf [general] port=5060 bindaddr=0.0.0.0 context=default tos=lowdelay disallow=all allow=ulaw register=> xxxxxxxxxxxxx:[email protected] ; NOTE: The line below ([gafachi]) can not be changed, otherwise your Asterisk ; system will reject calls, with a "403 Forbidden", from the Gafachi Network. [gafachi] type=friend username=xxxxxxxxxxxxxxxxxxxx secret=yyyyyyyyyyyyyy host= sip.gafachi.com canreinvite=no fromuser=xxxxxxxxxxxxxxxxxxxxxx dtmfmode=rfc2833 context=gafachi-incoming ----- Original Message ----- From: "Tony Graziano" < [email protected] > To: [email protected] Sent: Sunday, November 1, 2009 1:25:00 PM GMT -05:00 US/Canada Eastern Subject: Re: [sipx-users] sipxecs behind endian firewall In looking over your notes, there seems to be a more basic problem. If you are calling out and then getting disconnected after a certain amount of time it's usually because the ITSP and sipx are not agreeing you are connected properly to continue. If you are having audio issues it's most likely a RTP port setting not being matched up to what your ITSP is specifying (assuming they specify) and/or a firewall setting issue. Can you share what your ITSP has given as far as instructions? No authentication or IP address information is needed, just what they want from you in general. They should be able to provide a general setup guideline for SIP based systems. At the same time, if this gets to a usable state, there are some interoperability tests you should try (music on hold, transfers of calls, etc.), and provide this information for the wiki so noone has to go through this again with that carrier. The wiki has a grid of tested and known working configurations, new carriers, once tested, are added to the siptrunk template. On Sun, Nov 1, 2009 at 10:52 AM, Tony Graziano < [email protected] > wrote: Go to the gateway you created. Dialplan prefix is at the top. Make sure you are using the correct port range for media relay and the itsp (if itsp says to use a specific Range, you need to alter media relay AND pfsense accordingly). If you have a static ip you should not be using stun. You should make sure the itsp is sending on port 5080. ============================ Tony Graziano, Manager Telephone: 434.984.8430 Fax: 434.984.8431 Email: [email protected] LAN/Telephony/Security and Control Systems Helpdesk: Telephone: 434.984.8426 Fax: 434.984.8427 Helpdesk Contract Customers: http://www.myitdepartment.net/gethelp/ ----- Original Message ----- From: Francis Tinio < [email protected] > To: Tony Graziano < [email protected] > Cc: sipx-users < [email protected] > Sent: Sun Nov 01 10:45:01 2009 Subject: Re: [sipx-users] sipxecs behind endian firewall how can i change that in sipx? in the dialplan it only asks for a prefix and how many digits. btw made some progress. I'm able to call out but the call disconnects after 5 secs and one way audio. Then when I changed NAT from stun to IP, call does not disconnect but no audio at all. ----- Original Message ----- From: "Tony Graziano" < [email protected] > To: "Francis Tinio" < [email protected] > Sent: Sunday, November 1, 2009 4:34:44 AM GMT -05:00 US/Canada Eastern Subject: Re: [sipx-users] sipxecs behind endian firewall Weird. Not a lot of information on their site. You need to make sure you are not sending the "+" character at the beginning of the dialing string, they say they won't accept it. You need to be sending all calls to them as "1NPANXXNNNN". You can easily adjust your dialplans to do this and add your local area code to an 7 digit numbers and add the "1" to all calls via the gateway. You should put the proxy log in debug mode, go to cd /var/log/sipxpbx tail -f sipXproxy.log and watch the output when you dial the call to see what you are sending in the way of digits (as soon as you place the call and it fails, CTRL+C in your ssh client so you can scroll and see it). I don't know if this matters to you but, " By default our network requires SIP calls to be authenticated via MD5. If your equipment/software is incapable of this, and you would like IP-based authentication to be configured, you can configure this, once logged in, by following the link for "Setup IP-based Authentication".". I would consider this. Any carrier using a registration to a pbx is fraud waiting to happen, but right now your registration with them does not seem to be an issue. On Sat, Oct 31, 2009 at 7:46 PM, Francis Tinio < [email protected] > wrote: the only thing they are giving me is the asterisk settings. but we're not using asterisk. not sure where i should put those info in sipx. ----- Original Message ----- From: "Tony Graziano" < [email protected] > To: [email protected] Sent: Saturday, October 31, 2009 8:39:46 PM GMT -05:00 US/Canada Eastern Subject: Re: [sipx-users] sipxecs behind endian firewall Ok. So you register. Look at the itsp gateway settings and ask them what they want to see (keepalive character, etc). ============================ Tony Graziano, Manager Telephone: 434.984.8430 Fax: 434.984.8431 Email: [email protected] LAN/Telephony/Security and Control Systems Helpdesk: Telephone: 434.984.8426 Fax: 434.984.8427 Helpdesk Contract Customers: http://www.myitdepartment.net/gethelp/ ----- Original Message ----- From: Francis Tinio < [email protected] > To: Tony Graziano < [email protected] > Sent: Sat Oct 31 20:30:15 2009 Subject: Re: [sipx-users] sipxecs behind endian firewall nope it's not in the list. itsp is gafachi. when i log into their interface it shows that my server is registered ----- Original Message ----- From: "Tony Graziano" < [email protected] > To: [email protected] Sent: Saturday, October 31, 2009 8:25:31 PM GMT -05:00 US/Canada Eastern Subject: Re: [sipx-users] sipxecs behind endian firewall It makes a difference who the itsp is. Is the itsp in sipx as a template? ============================ Tony Graziano, Manager Telephone: 434.984.8430 Fax: 434.984.8431 Email: [email protected] LAN/Telephony/Security and Control Systems Helpdesk: Telephone: 434.984.8426 Fax: 434.984.8427 Helpdesk Contract Customers: http://www.myitdepartment.net/gethelp/ ----- Original Message ----- From: Francis Tinio < [email protected] > To: [email protected] < [email protected] > Sent: Sat Oct 31 20:13:22 2009 Subject: Re: [sipx-users] sipxecs behind endian firewall Yup has that as well :) ----- Original Message ----- From: Tony Graziano < [email protected] > To: Francis Tinio < [email protected] > Sent: Sat Oct 31 20:12:30 2009 Subject: Re: [sipx-users] sipxecs behind endian firewall make sure the sipx server has a default gateway of the pfsense box then On Sat, Oct 31, 2009 at 8:06 PM, Francis Tinio < [email protected] > wrote: will send you my config later. i checked and it does match up tho with yours. ----- Original Message ----- From: "Tony Graziano" < [email protected] > To: "Francis Tinio" < [email protected] > Sent: Saturday, October 31, 2009 7:07:44 PM GMT -05:00 US/Canada Eastern Subject: Re: [sipx-users] sipxecs behind endian firewall It's likely you missed some rules if you didn't match the xml up. Here are some helpers. Firewall>NAT>Port Forward WAN UDP 5060 <private sipx address> 5060 WAN TCP 5060 <private sipx address> 5060 WAN UDP 5060 <private sipx address> 5060 WAN UDP 30000-31000 <private sipx address> 30000-31000 WAN TCP 80 <private sipx address> 80 WAN TCP 8443 <private sipx address> 8443 WAN TCP <pfsense-gui-port> <pfsense private address> <pfsense-gui-port> OUTBOUND MANUAL OUTBOUND NAT RULE GENERATION = CHOSEN WAN <network address/cidr> * * * * * YES FIREWALL RULES LAN * LAN net * * * * WAN UDP * * <sipx private ip> 5060 * TCP * * <sipx private ip> 5060 * UDP * * <sipx private ip> 5080 * UDP * * <sipx private ip> 30000-31000 * TCP * * <sipx private ip> 80 * TCP * * <sipx private ip> 8443 * TCP * * <pfsense private ip> <pfsense gui port> * On Sat, Oct 31, 2009 at 6:42 PM, Tony Graziano < [email protected] > wrote: Also, your softphone (example/xlite) should have the following: topology: Use local address Discover STUN (blank) Enable ICE (no) Ports used/manually Specify, range is 30000-31000 On Sat, Oct 31, 2009 at 6:40 PM, Tony Graziano < [email protected] > wrote: or at least compare your xml config file against mine i've posted to see if you have missed anything? On Sat, Oct 31, 2009 at 6:39 PM, Tony Graziano < [email protected] > wrote: Then do you mind emailing me you backup config file? You can alter the IP's and passwords. Also, is your ITSP profile built in? Are you using xlite? Have you configured a dilaplan and chosen the gateway? On Sat, Oct 31, 2009 at 6:29 PM, Francis Tinio < [email protected] > wrote: ok got pfsense working. i configured it myself and have not used your config. anyway, when I try to make an outbound call, I get an error: ITSP Timed Out and the softphone supposedly hangs up. However, after that my cell phone rings. So the call somewhat goes through but the softphone disconnects before I can pick up on the other end. ----- Original Message ----- From: "Tony Graziano" < [email protected] > To: "Francis Tinio" < [email protected] > Sent: Saturday, October 31, 2009 10:29:40 AM GMT -05:00 US/Canada Eastern Subject: Re: [sipx-users] sipxecs behind endian firewall Right, but mine at are the clients site and these are there installations and their networks. I just find the openvpn easy to use in endian, but to go outside the few basic choices for the config it's VERY problematic. Plus you pretty much have to go the hard way to make a usable VMware compatible machine, getting tools into the ISO is too diffult, which means you have to build your own. pfSense was a 5 minute thing for me on my lab system where I also have a test sipx system running, and it works fine for me with bandwidth.com (my itsp). I keep a couple of test numbers pointed to my pfsense installation so I can spin up any version of sipx for limited testing. I can never get endian working NAT properly as it needs to for sipx. Plus the traffic shaping on pfsense looks straightforward. I hope to get an example of that worked out too. If you check my blog, I have a sample pfsense config (which IS easier to download,edit,restore than Endian as it is a XML document and does not have to be repackaged before uploading). If you haven;t looked at it yet, it's here: http://blog.myitdepartment.net/?p=37 I took a file from a customer site that I did first, added the VM to inventory, spun it up and put the IP's on it, logged in and made a backup, then edited the XML file and restored it. When it rebooted, my siptrunks worked great! On Sat, Oct 31, 2009 at 10:20 AM, Francis Tinio < [email protected] > wrote: I don't like to use openvpn as that means my clients will have access to my network. And my clients are not technically inclined so teaching them vpn is another hurdle. Lol ----- Original Message ----- From: Tony Graziano < [email protected] > To: Francis Tinio < [email protected] > Sent: Sat Oct 31 10:18:49 2009 Subject: Re: [sipx-users] sipxecs behind endian firewall I posted the question in their forum about static port nat, noone has responded. I always find their NAT (and routing) sometimes leaves a bit to be desired. I find their OPENVPN easy, but not flexible. On Sat, Oct 31, 2009 at 10:17 AM, Francis Tinio < [email protected] > wrote: ahh this must be esx format. i think i'll need to use the converter to use for esxi.. download converter. will keep you posted. also, did you see my post about the 2.3 endian making progress? i can register the extensions now and ring the other phone (although both in my PC). although no audio. also my itsp shows that it sees my server and it registers. hopefully we also get support for endian down the road, as I'm already used to it :) ----- Original Message ----- From: "Tony Graziano" < [email protected] > To: "Francis Tinio" < [email protected] > Sent: Saturday, October 31, 2009 10:12:50 AM GMT -05:00 US/Canada Eastern Subject: Re: [sipx-users] sipxecs behind endian firewall This is in my lab on vmware server 2.0, same as esx 2.5 i think. This is the file I unzipped: http://files.pfsense.org/vmware/pfSense-1.2.3-Prerelease.zip It is a vmx file, and it should either import or at least by convertible by your vmware server. If not, you should be able to install the ISO, however installing tools is another thing. On Sat, Oct 31, 2009 at 10:07 AM, Francis Tinio < [email protected] > wrote: hmm... are you using esxi or esx? We are using esxi 3.5. ----- Original Message ----- From: "Tony Graziano" < [email protected] > To: [email protected] Cc: [email protected] Sent: Saturday, October 31, 2009 10:06:46 AM GMT -05:00 US/Canada Eastern Subject: Re: [sipx-users] sipxecs behind endian firewall I did mine by unzipping it in my datastore. Then I added to inventory and it picked up the config file and it booted. ============================ Tony Graziano, Manager Telephone: 434.984.8430 Fax: 434.984.8431 Email: [email protected] LAN/Telephony/Security and Control Systems Helpdesk: Telephone: 434.984.8426 Fax: 434.984.8427 Helpdesk Contract Customers: http://www.myitdepartment.net/gethelp/ ----- Original Message ----- From: Francis Tinio < [email protected] > To: Tony Graziano < [email protected] > Cc: [email protected] < [email protected] > Sent: Sat Oct 31 10:00:40 2009 Subject: Re: [sipx-users] sipxecs behind endian firewall Tony, I have downloaded the vmware version of pfsense. i tried opening it but i get this error: Power On virtual machine New Virtual Machine Failed to open disk scsi0:0: "Unsupported and/or invalid disk type 7. Did you forget to import the disk first? Unable to create virtual SCSIdevice for scsi0:0" any suggestions? I just extracted the files and uploaded to my datastore, then reused the storage when i created a VM. No luck so far... ----- Original Message ----- From: "Francis Tinio" < [email protected] > To: "Tony Graziano" < [email protected] > Cc: [email protected] Sent: Saturday, October 31, 2009 9:25:36 AM GMT -05:00 US/Canada Eastern Subject: Re: [sipx-users] sipxecs behind endian firewall ok just a quick update. I tried installing the newer version of endian, 2.3. Now I can get both extensions to ring. i can also see when i log into my itsp provider, gafachi, that it has registered my server and can see it (it's at port 5080 instead of 5060). although i still cannot make phone calls other than local extensions, and i do not hear any audio (which I think this is because on my settings). I just downloaded pfsense as well and will install it later on. for now, I think endian 2.3 has progress and may be just some config error on my end... ----- Original Message ----- From: "Tony Graziano" < [email protected] > To: "Dave Black" < [email protected] >, [email protected] Sent: Friday, October 30, 2009 1:23:52 PM GMT -05:00 US/Canada Eastern Subject: Re: [sipx-users] sipxecs behind endian firewall As well, a pptp connection on pfsense seems to work well enough too, providing the remote user is on a softphone only. I have a dozen endian firewalls I manage. I've never gotten them to allow trunking/remote users if it sits in front of sipx. Always an audio issue. I have also posted a query on the endian forum (no answers yet). --stay tuned ============================ Tony Graziano, Manager Telephone: 434.984.8430 Fax: 434.984.8431 Email: [email protected] LAN/Telephony/Security and Control Systems Helpdesk: Telephone: 434.984.8426 Fax: 434.984.8427 Helpdesk Contract Customers: http://www.myitdepartment.net/gethelp/ ----- Original Message ----- From: [email protected] < [email protected] > To: sipx-users < [email protected] > Sent: Fri Oct 30 12:55:39 2009 Subject: Re: [sipx-users] sipxecs behind endian firewall Tony's explanation of symmetrical nat and how it can be implemented in pfsence is very help full. As for our configuration with Endian, we really haven’t run into any issues, probably because as Tony suggest, our Sipx config is quite simple however SipXBridge and sipx gateway is configured to connect directly to Acanc, not through an ATA as suggested. A bit of background: Acanac provides both an IP address and a FQDN to connect to their services. I use the IP address for simplicity sake as it is only used for testing in a development environment. Production environment we use Mediant 2000 for PSTN services. 1. We run Endian as the firewall with a static assigned public IP address (No STUN involved). 2. An Endian outbound firewall rule is created to allow all outbound traffic to Acanac's provided IP address. There is NO port forwarding rules to forward traffic on public port 5060, 5080 or the RTP range back to the sipx box. Endian takes care of this with the default allow_established rules. With this config, the only way a device on the public internet can make a connection back to sipx is by first sipx establishing a session with them, which is what sipxbridge/gateway does when it registers with acanac. 3. SipX is configured under Server -> NAT "Specify Address" with the static public IP at the endian interface and public port 5060 4. Sipx is configured under Devices -> SBC -> SipxBridge (all default values) 5. Sipx is configured under Gateways -> Acanac -> (all default values) except Address = IP Address provided by Acanac, ITSP account name and password. ITSP Server domain name = same IP address that Acanac provided. What this doesn't provide is a way for mobile workers on the internet to connect to SIPX directly. I would really like to see sip+tls and srtp implemented before letting users free on public or un-owned networks to freely transmit their credentials and conversations, but that’s me. Instead I prefer using OpenVPN to tunnel in. This simplifies sipx and firewall configuration and encrypts communications between remote worker and sipx, however it requires configuring an OpenVPN client on the remote worker side. There is definitely tradeoff and I'm sure this is not a one solution fits all type of thing, but it works for us. I've tried many different OpenVPN server scenarios, including installing OpenVPN directly on the sipx box and using Endian's OpenVPN implementation. Right now I've opted to use Vyatta which sits behind Endian for the OpenVPN server components. Hope this helps.. Again, it's what works for us and is probably not a one solution fits all. Dave B. -----Original Message----- From: [email protected] [mailto: [email protected] ] On Behalf Of Picher, Michael Sent: October 30, 2009 4:54 AM To: Francis Tinio; Tony Graziano Cc: sipx-users Subject: Re: [sipx-users] sipxecs behind endian firewall The VMWare version is available from their downloads section at www.pfsense.com Mike -----Original Message----- From: [email protected] [mailto: [email protected] ] On Behalf Of Francis Tinio Sent: Thursday, October 29, 2009 9:31 PM To: Tony Graziano Cc: sipx-users Subject: Re: [sipx-users] sipxecs behind endian firewall thanks for the detailed explanation. I would very much like to test out pfsense, where can I get the vmware version. my endian is actually also installed in vmware. My only concern with going this route is, I would have to reconfigure my cluster again if I were to switch my central firewall, that means some downtime with our servers. Also, I'm not really a freebsd guy, I'm just ok with linux (no where near you guys in skillset lol), so jumping to freebsd is a bit daunting. anyway, with your explanation of symmetric nat. what if instead of doing 1:1 nat, I only open 1 port incoming and the same port outgoing. that way the firewall will not change the ports right? so if I open, in one rule, port 5060 and nat it to 5060 of the internal IP, won't that be symmetrical at least since it's only 1 port we're dealing with? As for Dave, the openvpn you mentioned, is that an endian built in capability? how do you handle remote users then? If they work remotely (say a softphone in a laptop), do they need to connect to the vpn first before they can connect the softphone? I also agree with having a wiki with a list of firewalls and how it affects sipx in terms of useability and setup. Thanks. ----- Original Message ----- From: "Tony Graziano" < [email protected] > To: "Dave Black" < [email protected] > Cc: "sipx-users" < [email protected] > Sent: Thursday, October 29, 2009 10:20:31 AM GMT -05:00 US/Canada Eastern Subject: Re: [sipx-users] sipxecs behind endian firewall If it matters, your gateway is handling nat traversal via the ITSP very differently than a siptrunk. It's a gateway and not a siptrunk using sipxbridge. Endian only handles SNAT, source/softwires, but not symmetric NAT which is a requirement for sipxbridge. Your gateway (which is probably an FXS ATA) from acanac could also employ a stun server or other methods to traverse to their network so audio will work. There is probably nothing from you getting its local IP address and setting it up as a gateway in sipx and sending all calls to the AA or an extension. If so, that's nifty. For example, I have a voipo account for home use, it uses a linksys spa, I only needed to forward a couple of ports from my endian firewall at home in order for it to get out, register, and be usable. I can also connect a softphone to a test sipx server at my office but it would NEVER connect no matter what I did (and have 2 way audio for either direction on received or placed calls), until I put up a pfsense firewall and configured it properly. Your gateway (which is probably an FXS ATA) from acanac could also employ a stun server or other methods to traverse to their network so audio will work. If you are trying to connect to an ITSP with a siptrunk via sipxbridge, and your server is behind nat (or some of your remote users), you should employ a firewall capable of symmetric nat where sipx is located. I have a lot of customers using endian, but not with sipxbridge, because endian DOES_NOT_DO_THAT <period>. So if the question is "I want to employ sipxbridge at home with my ITSP to connect to a siptrunk provider and I use an Endian firewall, how do I do that?", the answer is "use a firewall capable of doing symmetric NAT, I don;t think endian is capable of doing so." If you dispute the capabilities of Endian, I suggest you post a question to a guru on their list of how to configure symmetric NAT. There might be a way to manually change this via VI but not from the user web interface. It is not on the list of features for the Open Source of the paid commercial version. If you get a way to make symmetric nat working on endian somehow, posting this would be a good idea. The sipxproxy (sipxroxd) is only used to connect many users inside your lan to a single external sip server, not for a b2bua like sipxbridge or for remote users connecting from the outside to sipxecs inside behind an endian firewall. Maybe a wiki page explaining firewalls used, with tips and tricks is needed here in regard to this type of question (what is generally known to work). Tony On Thu, Oct 29, 2009 at 8:05 AM, Black, Dave < [email protected] > wrote: Yup.. I use Endian EFW (Community), in my case, also installed under VMware. Have been using 2.2 since May and just upgraded to 2.3 yesterday. Works great. I use OpenVPN to connect remote phones so the firewall doesn’t really play a role for that. I don’t do too much with SipxBridge, but do have a gateway configured to connect to Acanac, a small ITSP out of Mississauga. I use them primarily for testing configurations. By default, Endian will have the outbound firewall enabled. Don’t enable the SIP proxy in Endian. All I need to do with Endian to connect to Acanac was to open up the outbound firewall (all ports, TCP/UDP) to the IP addresses Acanac provided me. When Sipx registers with Acanac, Endian automatically uses the allow established rules and creates the necessary NAT translations as ports are requested… That was it for me.. Dave B. From: [email protected] [mailto: [email protected] ] On Behalf Of Tony Graziano Sent: October 29, 2009 6:09 AM To: Picher, Michael Cc: sipx-users Subject: Re: [sipx-users] sipxecs behind endian firewall Just to save you some trouble, Endian does not do symmetric nat at all. Symmetric NAT § Each request from the same internal IP address and port to a specific destination IP address and port is mapped to a unique external source IP address and port. § If the same internal host sends a packet even with the same source address and port but to a different destination, a different mapping is used. § Only an external host that receives a packet from an internal host can send a packet back. It can do SNAT, nut this is not souce based NAT, it is softwires nat, which is used for encapsulation. Replacing it would be your best option. It it matter, pfsense has a vmware loadable image you can use, and is very easy on system resources. On Thu, Oct 29, 2009 at 4:08 AM, Picher, Michael < [email protected] > wrote: I have not tested that firewall personally. As a general rule however, you would want to make sure and disable the sip proxy in endian. Mike -----Original Message----- From: [email protected] [mailto: [email protected] ] On Behalf Of Francis Tinio Sent: Thursday, October 29, 2009 3:00 AM To: sipx-users Subject: [sipx-users] sipxecs behind endian firewall Hi. >From a previous topic I wa having, it seems that endian might be a cuplrit with sipx working behind an endian firewall. unfortunately for me, I'm in no position to replce the firewall right now as it will be more work to change. has anyone been able to get sipx to work behind endian firewall? any pointers? did you enable sip proxy in endian fw? thanks in advance. francis _______________________________________________ sipx-users mailing list [email protected] List Archive: http://list.sipfoundry.org/archive/sipx-users Unsubscribe: http://list.sipfoundry.org/mailman/listinfo/sipx-users sipXecs IP PBX -- http://www.sipfoundry.org/ _______________________________________________ sipx-users mailing list [email protected] List Archive: http://list.sipfoundry.org/archive/sipx-users Unsubscribe: http://list.sipfoundry.org/mailman/listinfo/sipx-users sipXecs IP PBX -- http://www.sipfoundry.org/ - _______________________________________________ sipx-users mailing list [email protected] List Archive: http://list.sipfoundry.org/archive/sipx-users Unsubscribe: http://list.sipfoundry.org/mailman/listinfo/sipx-users sipXecs IP PBX -- http://www.sipfoundry.org/ _______________________________________________ sipx-users mailing list [email protected] List Archive: http://list.sipfoundry.org/archive/sipx-users Unsubscribe: http://list.sipfoundry.org/mailman/listinfo/sipx-users sipXecs IP PBX -- http://www.sipfoundry.org/ _______________________________________________ sipx-users mailing list [email protected] List Archive: http://list.sipfoundry.org/archive/sipx-users Unsubscribe: http://list.sipfoundry.org/mailman/listinfo/sipx-users sipXecs IP PBX -- http://www.sipfoundry.org/ _______________________________________________ sipx-users mailing list [email protected] List Archive: http://list.sipfoundry.org/archive/sipx-users Unsubscribe: http://list.sipfoundry.org/mailman/listinfo/sipx-users sipXecs IP PBX -- http://www.sipfoundry.org/ _______________________________________________ sipx-users mailing list [email protected] List Archive: http://list.sipfoundry.org/archive/sipx-users Unsubscribe: http://list.sipfoundry.org/mailman/listinfo/sipx-users sipXecs IP PBX -- http://www.sipfoundry.org/ _______________________________________________ sipx-users mailing list [email protected] List Archive: http://list.sipfoundry.org/archive/sipx-users Unsubscribe: http://list.sipfoundry.org/mailman/listinfo/sipx-users sipXecs IP PBX -- http://www.sipfoundry.org/ _______________________________________________ sipx-users mailing list [email protected] List Archive: http://list.sipfoundry.org/archive/sipx-users Unsubscribe: http://list.sipfoundry.org/mailman/listinfo/sipx-users sipXecs IP PBX -- http://www.sipfoundry.org/ -- ====================== Tony Graziano, Manager Telephone: 434.984.8430 Fax: 434.984.8431 Email: [email protected] LAN/Telephony/Security and Control Systems Helpdesk: Telephone: 434.984.8426 Fax: 434.984.8427 Helpdesk Contract Customers: http://www.myitdepartment.net/gethelp/ -- ====================== Tony Graziano, Manager Telephone: 434.984.8430 Fax: 434.984.8431 Email: [email protected] LAN/Telephony/Security and Control Systems Helpdesk: Telephone: 434.984.8426 Fax: 434.984.8427 Helpdesk Contract Customers: http://www.myitdepartment.net/gethelp/ -- ====================== Tony Graziano, Manager Telephone: 434.984.8430 Fax: 434.984.8431 Email: [email protected] LAN/Telephony/Security and Control Systems Helpdesk: Telephone: 434.984.8426 Fax: 434.984.8427 Helpdesk Contract Customers: http://www.myitdepartment.net/gethelp/ -- ====================== Tony Graziano, Manager Telephone: 434.984.8430 Fax: 434.984.8431 Email: [email protected] LAN/Telephony/Security and Control Systems Helpdesk: Telephone: 434.984.8426 Fax: 434.984.8427 Helpdesk Contract Customers: http://www.myitdepartment.net/gethelp/ -- ====================== Tony Graziano, Manager Telephone: 434.984.8430 Fax: 434.984.8431 Email: [email protected] LAN/Telephony/Security and Control Systems Helpdesk: Telephone: 434.984.8426 Fax: 434.984.8427 Helpdesk Contract Customers: http://www.myitdepartment.net/gethelp/ -- ====================== Tony Graziano, Manager Telephone: 434.984.8430 Fax: 434.984.8431 Email: [email protected] LAN/Telephony/Security and Control Systems Helpdesk: Telephone: 434.984.8426 Fax: 434.984.8427 Helpdesk Contract Customers: http://www.myitdepartment.net/gethelp/ -- ====================== Tony Graziano, Manager Telephone: 434.984.8430 Fax: 434.984.8431 Email: [email protected] LAN/Telephony/Security and Control Systems Helpdesk: Telephone: 434.984.8426 Fax: 434.984.8427 Helpdesk Contract Customers: http://www.myitdepartment.net/gethelp/ -- ====================== Tony Graziano, Manager Telephone: 434.984.8430 Fax: 434.984.8431 Email: [email protected] LAN/Telephony/Security and Control Systems Helpdesk: Telephone: 434.984.8426 Fax: 434.984.8427 Helpdesk Contract Customers: http://www.myitdepartment.net/gethelp/ -- ====================== Tony Graziano, Manager Telephone: 434.984.8430 Fax: 434.984.8431 Email: [email protected] LAN/Telephony/Security and Control Systems Helpdesk: Telephone: 434.984.8426 Fax: 434.984.8427 Helpdesk Contract Customers: http://www.myitdepartment.net/gethelp/ -- ====================== Tony Graziano, Manager Telephone: 434.984.8430 Fax: 434.984.8431 Email: [email protected] LAN/Telephony/Security and Control Systems Helpdesk: Telephone: 434.984.8426 Fax: 434.984.8427 Helpdesk Contract Customers: http://www.myitdepartment.net/gethelp/ _______________________________________________ sipx-users mailing list [email protected] List Archive: http://list.sipfoundry.org/archive/sipx-users Unsubscribe: http://list.sipfoundry.org/mailman/listinfo/sipx-users sipXecs IP PBX -- http://www.sipfoundry.org/ -- ====================== Tony Graziano, Manager Telephone: 434.984.8430 Fax: 434.984.8431 Email: [email protected] LAN/Telephony/Security and Control Systems Helpdesk: Telephone: 434.984.8426 Fax: 434.984.8427 Helpdesk Contract Customers: http://www.myitdepartment.net/gethelp/ _______________________________________________ sipx-users mailing list [email protected] List Archive: http://list.sipfoundry.org/archive/sipx-users Unsubscribe: http://list.sipfoundry.org/mailman/listinfo/sipx-users sipXecs IP PBX -- http://www.sipfoundry.org/ -- M. Ranganathan _______________________________________________ sipx-users mailing list [email protected] List Archive: http://list.sipfoundry.org/archive/sipx-users Unsubscribe: http://list.sipfoundry.org/mailman/listinfo/sipx-users sipXecs IP PBX -- http://www.sipfoundry.org/ _______________________________________________ sipx-users mailing list [email protected] List Archive: http://list.sipfoundry.org/archive/sipx-users Unsubscribe: http://list.sipfoundry.org/mailman/listinfo/sipx-users sipXecs IP PBX -- http://www.sipfoundry.org/
