IP Telephony - NBX
cancel
Showing results for 
Search instead for 
Did you mean: 

NBX and firewalls

mswann60_1
Advisor

NBX and firewalls

I thought I would step in again and try to get my NBX to work across our Astaro ASG  firewall. I am still struggling with this.  HP/3com ever written a document about port usage similar to this http://support.microsoft.com/kb/832017?

 

 

Here is my struggle.

1. I cant get the PCXSET to work across VPN

 2. Astaro has a bridge product that was supposed to be plug and play, but cant get a 3102 to communicate remotely through the bridge.

3. I am happy with the 3com product but cannot purchase technical support.

4. The guy that originally set up the ASG probably did substandard work or was "dangerlously knowledgable" and I got tired of wasting money on him.

5. Astaro tech support was unable to solve the problem.

6.  The Astaro recommended field tech couldnt get it to work and blamed it on the NBX.

 

 

Waaaa! Ok, I am done whining. Any suggestions?

15 REPLIES
bosoxfan
Trusted Contributor

Re: NBX and firewalls

Call setup and audio on the NBX use ports 2093-2096 if in non-SIP mode.

if in SIP Mode, port 5060 is the SIP port by default, ports 8xxx are for the RTP audio.

Remember on your PC.. first you need to connect to the VPN, then start up the PCxset configuration wizard, chose

the right "adapter", then try a test call.

merlin215
Valued Contributor

Re: NBX and firewalls

3102 tels require a hardware vpn set up . A software vpn is not supported , only for pcxsets . 

mswann60
Frequent Advisor

Re: NBX and firewalls

OK, we have some progress.

I hired a guy that got the hardware VPN (Astaro RED) device working "somewhat".

 

Our office network is DCHP'ed by the fire wall and has a .1.1 domain. The remote VPN hardware has a .4.1 domain and DCHP's locally.


We have a 3102 handset  that we configured in the office by auto discovery. We took it to the remote office and get the error message "wait for NCP M". System is set up for IP on the Fly.

 

We have the remote VPN device set for "any" communication each direction with the "in office" system. The next thing to try will be invoking some multicasting rules. All multicasting should be able to pass on 124.0.1.x domain?

 

The phone is the only thing connected to the VPN device. Angry IP reports no ip address for any of the handsets when scanned from the .1.1 or .4.1 domain. The NBX Telephone configuration>Telephones>IP settings is not reporting an address for the remote phone.  I tried arbitrarily setting an IP address, subnet and gateway at the correct domain, but this did not work either. The odd thing is if I plug in my laptop that has pcXset installed, it works fine. A screen shot of the NBX IP status is attached

 

Here is a traffic monitor that is going on at the VPN device.

 

Proto Source IP Port Destination IP Port Bytes in Pkt in Bytes out Pkt out

udp 0.0.0.0 68 255.255.255.255 67 1146 3 0 0

icmp 192.168.4.1 - 192.168.4.254 - 48 1 0 0

 

Something that is troubling, is the udp 0.0.0.0 response on the packet monitor. Its always paired with the vpn device, 1628 times a day.

  

Finally and unrelated, my software tunnel  for the pcXset is communicating with the NBX on port 143, what is port 143 for?

 

tcp 10.242.2.6 3271 192.168.1.15 143 115 2 128 2

 

I am beginning to feel confident that I might actually get this worked out within my lifetime. Any comments?

merlin215
Valued Contributor

Re: NBX and firewalls

Your local router at the far end ( home or office ) needs to supply an IP address ( static or DHCP ) before anything can work . If not then in the tel you must statically assign one . I assign the last or a few from the last IP address in my Router range . USe the buttons on the tel and program the IP address syubnet and default Gateway . Then Program the NBX IP address as well ( across the VPN ) . Now the tel will boot up on ports 2093 thru 2096 and try to contact the NBX . A network trace at the near end ( vpn entry point to the network ) , and look to see if the NBX packets ( layer 3 packets ) are getting to the netwokr . 

 

You never stated what type of VPN so I have to assume that Astaro is creating a point to point VPN . You may have issues with Multicast if you set it up for an IPsec . tunnel .  You should set it up as a GRE in order to let traffic flow . PCXSet works entirely different than a 3102 tel . Different ports as well  ( 2093 thru 2096  UDP Ports ) . Port 143 is a port used on the PCXSet for the NBX ( unique selection by our programmers ) . 

mswann60
Frequent Advisor

Re: NBX and firewalls

Its the Astaro RED vpn interface device. http://www.astaro.com/products/astaro-red What they dont tell you is you have to write all the filter/network service rules both ways. Its a very powerful system, but complicated to a novice.

 

Your right, the 3102 is not getting an IP address. We recognized that its part of the firewall hardware set up problem (self inflicted). We are going to work on this some more next.

 

Is the manual porgramming of the 3102 (if required) covered in the V3000 documentation?

 

On handling the IP address to/from the 3102/NBX is one of the things that is confusing me; is this handed by the NBX/V3000's IP on the fly service? Is it to be done at the local gateway? is this done on normal IP traffic for multicast traffic?

 

Thanks for your reponse Merlin.

merlin215
Valued Contributor

Re: NBX and firewalls

There are 2 things here :

 

1. IP On The Fly . 

 

2. Static IP settings

 

The NBX uses IPOTF on tels local to the NBX ( Layer 2 tels in the NBX subnet ) not in a different subnet . The tel in your remote location is in a different  subnet , so It needs an IP address from that subnet , hence DHCP or STATIC IP on the tel . either way is acceptable . 

mswann60
Frequent Advisor

Re: NBX and firewalls

That actually makes sense. Thanks.
merlin215
Valued Contributor

Re: NBX and firewalls

You're welcome and good luck . Let us know how you make out ....

mswann60
Frequent Advisor

Re: NBX and firewalls

Hi Merlin,

 

I had time again to work on this. Made some changes last night.

 

The internal network is 192.168.1.0 with a 255.255.255.0 subnet mask and the remote network is 192.20.1.0 with a 255.255.255.0 subnet mask.

 

 

We now have the ability to ping IP's both ways to/from internal and remote networks. My remote PC links up ok with the exchange server. For what ever reason, the remote device will assign a IP to a PC bit will not assign an IP to the 3102. For reference, can I have a list of ethernet ports needed for the 3102/V3000?

 

 

Any comments?

 

merlin215
Valued Contributor

Re: NBX and firewalls

IS DHCP / Option 184 being used ? Sounds like an issue with your DHCP per the info supplied ...

 

UDP

2093

2094

2095

2096

TCP 

1030

1040

HTTP

80

mswann60
Frequent Advisor

Re: NBX and firewalls

Where would this DHCP setting be? I looked at the administrator's console, but couldnt find it.

merlin215
Valued Contributor

Re: NBX and firewalls

DHCP would be on the network somewhere as an external device , or maybe part of the router . Try statically assigning an IP address to the tel , and if necessary , any other info manually enter into the tel , then reboot and see what occurs . If it works then you are not getting any IP / DHCP/Option 184  info form your DHCP server and you would have to program this into it  - enable option 184 for the tels . Suurprised this was not on before . 

mswann60
Frequent Advisor

Re: NBX and firewalls

Just about there, I checked at the console this morning and the 3102 is online.

 

It is showing an error code. I monitored the packet filter for 20 minutes, no drops for the V3000 or the 3102

 

 

Time Last Seen:   20110722:095049   Error Count:   0   Error Code:   0xFFFF  

Performance Data:  

0027 0000 0000 0000 0000
0000 0000 0000 0000 0000
0000 0000 0000 0000 0000
0000 0000 0000 0000 0000
0000 0000 FFFF 0000 0000
0000 3214 0001 0000 0000
0000 AAAA
 

Debug Data:  

0014 00A4 0000 0000 0000
0000 0000 EA00 EA00 13D0
AAAA AAAA AAAA AAAA 0000
0000
 

Actor Data:   State:Idle;Msg:deviceStatus;Po
rt(Id): pDeviceInterface(0);

 

 

mswann60
Frequent Advisor

Re: NBX and firewalls

Ok, I have all the features working except that when I select call distribution groups>hunt groups>users>show all, the remote extension will not populate. OOPS,  its an IE 8/9 bug, must use Firefox when interfacing with the V3000/NBX.

merlin215
Valued Contributor

Re: NBX and firewalls

IE 9 is not suporoted on the NBX . Only IE 6 . Security stuff never figured out here . Google Chrome should work as well but you are correct as it sounds like an IE bug versus anything else . Saw a lot of wierd unexplainable stuff happen with ie8 and 9