We have a remote office that will have 7 desk phones. In the past we have installed
a seperate PBX at each remote location. I was thinking of a way to just have the 7
phones at the reomte office connect back to the pbx at HQ. The remote office will have a ipsec
site to site vpn connecting ot HQ for other purposes. My question is should I:
A. connect the 7 phones across the site to site ipsec VPN?
B, configure a OpenVPN server on the pbx at HQ and configure each phone at the
remote office as a client?
c: use built in TLS/SRTP to connect the phones at the remote office back to the pbx at HQ without a vpn?
There is no universally “better” option here; the right design depends on where you want the encryption boundary, how much operational complexity you are willing to manage, and what level of Internet exposure you are comfortable with.
Having phones as VPN clients sounds like a support nightmare – but so does having onsite PBXs. IMO a VPN would be overkill if you’re not a government or multinational corp.
But if you do go without VPN, make sure you’re not just securing SIP and RTP, but also your provisioning method. (If the phones don’t support something encrypted, use the ipsec tunnel for your provisioning.)
Sure, you don’t have to do anything, except maybe change a few firewall rules. Unless there is a gotcha you haven’t yet noted, it should even be possible to test a phone at HQ, then install it in the branch without making any changes.
Our organization has 18 remote sites from our corporate office and our onsite FreePBX instance. Each of the remote sites has a gateway to gateway (site to site) IPSEC VPN back to the corporate office gateway. Each VPN supports multiple application needs including the remote site telephony. The VPN is already in place, so there is no additional administration or support overhead to pinning up or maintaining another connection.
A consideration is that this does introduce a single point of failure for each remote site should the VPN go down. We use PRTG Network Monitor at our corporate office to monitor and notify regarding the status of the VPN’s, services, and much more.
Each remote site has either a single ATA device or an IP desk telephone. These register to the corporate location FreePBX using it’s private LAN IP address routed within the VPN tunnel.
This setup works quite well and is the lowest of the bandwidth uses of the remote VPN’s.
We added each remote locations IP network address block to FreePBX → Connectivity → Firewall under the “Network” tab as a “Trusted” network. Also under the “Intrusion Detection” tab we add to the “Whitelist”. If you are using FreePBX Endpoint Manager (EPM) to manage endpoint configurations and firmware, be sure to have a configuration in the endpoint to point them at the server as well.
This pretty much is identical to how we first deployed FreePBX in our organization. We have Meraki equipment throughout, and the S2S VPN architecture has the tunnels baked right end. Each Meraki firewall has primary fiber DIA and secondary Internet with a different provider to provide redundant connection paths. While remote users at home and otherwise outside of our corporate networks could be outliers, I was able to configure those for VPN access in those oddball instances.
At a certain point as we grew, I wanted to steer away from an on-prem FreePBX server for our entire organization. So I spun up an AWS EC2 instance to provide the service instead. While I keep it simple and only allow our company networks to access it through security groups, I could implement similar S2S VPN’s if I wanted to.
And I’ve been using PRTG for years, and can’t say enough about what a good tool it is to have in the old belt.
We have a client with 3 locations. a basic full site to site VPN setup allows you to take the remote site and access the main site via IP Addresses.
So if the main sites is 192.168.1.1, and the FreePBX server is at 192.168.1.20
and the remote site is 192.168.2.1 (the remote site needs a different subnet than main site.)
Then any phone on the .2 subnet can actually have a direct IP address for the FreePBX server as 192.168.1.20 because the VPN would translate where the .1.20 is located.
Likewise, from the main site you can then access the remote phones IP address directly if you need to see if it is online or program it.
Thank all of you for your input! I wonder does anyone have any suggestion in the configuration of the IPSEC VPN site-to-site tunnel that you have found to optimize performance?
Depends on the firewall or router hardware that’s in place at each site. There are various configuration options in terms of authentication, encryption, hashing, etc. for IKE Phase 1 and IPSEC Phase 2. Have to look at vendor documentation and then cross-reference configuration options are are compatible across any different vendor hardware.
