VigorBX 2000 - Registering Remote Extensions

PBX Configuration

The VigorBX 2000 PBX system will only allow IP phones that are in its local subnet(s) to register, by default.

This means that if a phone attempts to register over a VPN or over the internet (WAN interface), the PBX system will ignore the registration attempts.

To change this behaviour, go to [IP PBX] > [PBX System] > [SIP Proxy Setting]:

These settings control the PBX system's SIP registration for IP phones. Untick the Disable remote registration tickbox to enable registration over VPN or WAN and Tick "Enable ACL" then specify the remote IP addresses that will be allowed to connect by clicking Edit ACL which will pop-up the ACL list:

Specify the allowed internet IP addresses in this list then click Close to go back to the SIP Proxy settings.

• Untick the Disable remote registration tickbox to enable registration over VPN or WAN
• The SIP Local Port setting is the port that the PBX system listens on for SIP registrations and communicates to IP phones with. This guide explains how to change this setting if required: Changing SIP Ports on the VigorBX 2000
• The SIP Proxy Realm is the hostname that the PBX system will allow IP Phone's to register with, if registering remotely. If the hostname being used to register does not match the SIP Proxy Realm address, the PBX will send a Forbidden response to the IP Phone trying to register
• RTP Local Port Start/End controls the port range used for RTP (Real Time Protocol) audio streams. This should not be changed from its default
• Limit SIP Request WAN limits the number of SIP requests that the PBX system can respond to from a remote IP address per second. This should be enabled, the default value is 5 SIP packets per second
• Enable ACL operates as a White List, which if enabled will only allow local and VPN registrations. Registrations from internet IP addresses must be specified in the ACL.
• Automatic block Extension for wrong password will block an extension from registering if an IP phone attempts to register with the incorrect password more than the number specified. When blocked, the extension can only be unblocked by restarting the PBX system

Click OK to save that setting, which will prompt to restart the PBX system. Click OK again to restart the PBX system and apply the setting change.

Once the PBX system has restarted, the Extension Profiles will need to have WAN registration enabled. Go to [IP PBX] > [Extension] and click on the Index number for the extension to modify:

In the Extension Profile settings, the options to Allow Remote Registration will now be available. It is best practise to set the Password in the Extension Profile to a strong password that would be less susceptible to brute force or dictionary attacks, using a mixture of upper-case, lower-case, numbers and special characters.

To enable registration over the internet for this extension, Tick the WAN option:

Click OK to save and apply that change. IP Phones will now be able to register with that Extension Profile across the internet.

IP Phone Configuration

The IP Phone connecting to the PBX system will need to connect to the PBX system's WAN IP address or hostname if there is a hostname linked to the IP. Registering to the PBX system will often work without configuring any other settings but because of the way that SIP works, calls are likely to have one-way audio or no audio because the phone would not be aware of the internet connection's WAN IP address and would send its local IP for call audio routing.

To help with this, there are two methods:

• SIP-ALG (Session Initiation Protocol - Application Layer Gateway) - This is a facility available on many NAT routers (including all current DrayTek routers) which modifies the IP address details in SIP packets from local IP addresses to routable public IP addresses, assuming that the router performing SIP-ALG has a direct connection to the internet.
• STUN (Session Traversal Utilities for NAT) - A STUN server assists an IP phone with determining the public IP address of the internet connection that it is routing through.

{tab-ex SIP-ALG}

To use SIP-ALG, this would need to be enabled on the router that the IP phone is connecting through. This is not enabled by default on DrayTek routers and can be enabled by following this guide: SIP-ALG on DrayTek Routers

Once that has been enabled, the router will modify the SIP packets and modify the call setup packets to include the correct internet IP addresses.

To configure this on the IP Phone, with a Yealink T26P shown here as an example, set up the remote extension with the IP or Hostname of the PBX system as the SIP Server / SIP Registration Server and specify the configured SIP port of the PBX as the Port:

The NAT Traversal or STUN settings do not need to be enabled. It may also be beneficial to enable the Rport setting if the phone has that available:

When the phone has registered, it should then be able to make and receive calls with the PBX system.

{tab-ex STUN}

Setting up a STUN server on a handset requires a STUN server, which is not provided by the VigorBX 2000 system and may be available from your ITSP. We cannot provide recommendations of which STUN server to use as that can vary depending on the SIP provider and location.

To configure STUN on the IP Phone, with a Yealink T26P shown here as an example, set up the remote extension with the IP or Hostname of the PBX system as the SIP Server / SIP Registration Server and specify the configured SIP port of the PBX as the Port.

Set the NAT Traversal setting to STUN and specify the STUN Server and Port (by default UDP 3478):

When the phone has registered, it should then be able to make and receive calls with the PBX system. If the phone is unable to register or there is delay when making or receiving calls, test with a different STUN server to determine whether that helps with registration or call issues.