I finally got TLS configured and working to allow encrypted communication between a remote telephone and our PBX however it is still showing UNREACHABLE in the Endpoint Manager.
I did change the TLS port to a non-standard port of 5062 however it shows 5060 in EM.
Anyone know how to resolve this? I’d like to have it show up as being registered to facilitate troubleshooting.
The other thing that I’ve notice
I am seeing a lot of these messages as well
tcptls.c:1102 ast_tcptls_client_start: Unable to connect SIP socket to 10.10.113.165:5060: Connection refused
The picture here is not Endpoint Manager, this is the peers section, and the port there is the local port, not the port it’s trying to register on.
Ok. Can you explain the process what you did to get your phones TLS done?
Also, is 5062 forwarded to your PBX?
TLS/SRTP with Sangoma phones is all managed thru EPM:
https://wiki.freepbx.org/display/PHON/TLS+and+SRTP
Certificates were already setup - we have Zulu working presently
Followed the process to enable TLS for Chan SIP here TLS and SRTP - Phones - Documentation
Change SIP Settings to enable TLS, change port to 5062
Set to no for Don’t check server
Change Endpoint manager > global settings > external IP address to match FQDN name associated with our certificate.
Opened TCP port 5062 in Firewall going to the FreePBX server
Set the extension Transport to TLS Only, Enable Encryption: Yes (SRTP only)
Rebuild the provisioning profile
Factory reset the phone - have it provision via HTTPS provisioning by way of DHCP option 66
You are correct, the picture was of the SIP Peers. See the picture below of the Endpoint Manager
Thanks for the help
Chan SIP Settings > TLS Settings
Note: blurred out the certificate name but it is FQDN
Chan SIP Settings > Advanced General Settings
Where did you change that?
Did you restart Asterisk after making that change?
I did fwconsle restart
I restarted the entire PBX this morning as well
Show an actual call to the device.
asterisk -r
sip set debug on
call the device and copy and paste the output to pastebin and give us the link.
I will do that as soon as I can
Thanks!
This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.
