Firewall IPv6 issue?

[randynealpetersen]

Love this phone system
Asterisk / FreePBX / Chan SCCP / SCCP Manager - very cool...
Thanks to all you experts for your hard work!

2 things....

I have several phones outside of our work office/network.
I set them up, and then I add the outside IP as a "trusted network" and they have been working fine.
I went to install another one at a co-workers house and his ISP gave him a IPv6 IP, popped that in the firewall and nothing. Do I need to enable IPv6 within SCCP manager? any guesses on what I am doing wrong? The phone works fine at other outside network, just not his IPv6 network, make me thing (perhaps wrongly) it's something with his IPv6 address.

Also, not as important. When I set up a phone everything works great. Except when it's an outside line I have to go back into the SEPxxxxxxxxxxx.cnf.xml file and change the processNodeName from out internal IP to our outside IP. I figured I was just not setting up the device configuration correctly? or maybe the template? Other than that small issue, adding extensions is super simple.

Any thoughts?
Thanks,
Randy

[PhantomVl]

Unfortunately, I don't have enough experience in IPv6. However, for IPv6 to work correctly, both the server and the client must be configured to work in an IPv6 network. You cannot configure IPv4 on one side and IPv6 on the other, It's not work. If you have only one client in the ipv6 network then I would build a VPN through the provider's network (private ipv4 over ipv6 vpn)

[dkgroot]

@randynealpetersen

Sorry it took me a while to notice your request !

chan-sccp and asterisk do support ipv6. Only newer (java based) cisco phones support ipv6 for example the 7962 etc. The only requirement on the server side is to make these two changes
sccp.conf:

[general]
bindaddr=::       ; this will put the server in so called ipv4/ipv6 dual mode and allow connections over either

SEPxxxxx.cnf.xml:

<device>
   .... 
  <ipAddressMode>2</ipAddressMode><!-- 0 = IPv4 only, 1 = IPv6 only,  dual mode = 2-->
  <ipPreferenceModeControl>1</ipPreferenceModeControl><!-- IPv4 = 0, IPv6 = 1 -->
   .....
   <devicePool>
      <callManagerGroup>
         <members>
            <member priority="0">
               <callManager>
                  <name>asterisk</name>
                     <ipv6Addr>2002:123:5::1233</ipv6Addr>    <!-- note i think this would add/set a static ip-address on the phone and might not be what you want. Test before you use -->
                     <processNodeName>2002:123:5::333</processNodeName>
                     <!-- or -->
                     <processNodeName>asterisk.example.com</processNodeName>
                 </callManager>
             </member>
          </members>
       </callManagerGroup>
    .....
</device>

This latter part will put the device in ipv4+ipv6 dual mode and attempt to connect to the server preferrably over ipv6.

@PhantomVl I don't know in how far the current sccp_manager implementation works to enable setting these, editing the xml template should not be an issue i assume. And if need be we should be able to make a small change to the gui to allow for the "::" entry in bindaddr. I just noticed that the current sccp_manager implementation only supports one bindaddr line and seems to only focus on ipv4, i guess this would have to be fixed. You can have multiple lines of bindaddr in sccp.conf including both ipv4 and ipv6 addresses. I guess we should copy this implementation from the "Asterisk SIP Settings" page.

@randynealpetersen
Note: Mearly getting an ipv6 address on a firewall/router port does not automatically mean you have a fully ipv6 path to the internet. you would have to run some tests (there are ipv6 test websites out there) to make sure you can get packets back/forth over the link. It's also imported to have the same on the other side as well.
Note2: The type of ipv6 address you get can determine if you can use a direct site-site ipv6 address to communicate without any nat/proxying required...
Note3: The naked sccp/skinny protocol does not have any security measures build in, so makes sure you know the risk of hooking sccp devices straight over the internet into your pbx, this might create a security hole. It might be wiser to user a VPN pipe instead. This is not directly related to using ipv6 of course, the same goes for ipv4.
Note4: We do support sccp over TLS since the beginning of this year, if you have any questions about how to set this up, please let me know. Currently this feature is not documented on our wiki.

Again sorry for the late reply