[SOLVED] IPsec VPN and FreePBX provisioning

[tek9]

Hi all, hoping someone can help me here.
One of my clients has the following setup:
Site A=HQ: Untangle NGFW at the edge with a FreePBX on prem phone server sitting there.
Site B=Satellite Office: Another Untangle NGFW at the edge.
I've setup a site to site IPSec VPN between the two Untangles to get the Satellite Office phones connected to the FreePBX system and it's working fine for the past few years.
Now this client is outsourcing some work to some new hires in Manila and we want to get those people connected to the phone system as well. We're planning on using the MicroSIP softphone app to enable them to use their computers as virtual phones and I've setup a site to site VPN between the HQ Untangle and the remote office's Sonicwall router. The VPN shows as connected on both of our ends but they're unable to provision the test phone account I've setup with them. It's just timing out each time.
In order to troubleshoot the matter, I've setup a site to site VPN from my own office, using an Untangle NGFW and the VPN comes up fine, I can ping the phone server and login to the client's Untangle web GUI etc, but the softphone app won't connect. Also tried with a physical deskphone, same issue.
The strange thing is that I also have an on-demand Wireguard VPN connection to this client and when I'm connected via Wireguard it works flawlessly. It's the the IPsec site to site VPN that doesn't allow the phone system to work.
TLDR; Site to Site VPN (between Untangles or Untangle-Sonicwall) works fine for everything except for FreePBX. Wireguard VPN connection works fine without issue. But the two client offices are connected with a site to site VPN with no problems.
Any ideas what might be the cause of this?
Thanks in advance.

 

[putz]

Is there a firewall on the FreePBX system that needs to have the remote networks added to it as trusted or allowed? What are the network differences/similarities when connecting to WG? Does it put you on the same subnet as the working phones or is it different?

 

[HCHTech]

Packet capture on the receiving end's Sonicwall would tell you if traffic is being dropped and why...

 

[tek9]

FreePBX has a built in "Responsive Firewall" and the IP off the router is allowed, which is, presumably, where the inbound traffic from the remote sites are coming into.
When connecting through WG it sets up a random IP address, but that's not specifically allowed through the firewall. Regardless, WG has all local subnets added to the "allowed IPs".
The site-to-site VPN is also allowing all subnets on both ends.
What's odd is that the existing site-to-site VPN between their two offices are working fine from day one.

 

[tek9]

NVM. It was a setting on the FreePBX firewall that I missed. Thanks for pointing me in the right direction.