When 3CX calls have one-way audio, no audio, or drop after about 30 seconds, the cause is almost always the network between the PBX and the outside world, not 3CX itself. Check four things in order: turn SIP ALG off on the router; forward UDP 9000-10999 (audio) and 5060/5090 (signalling) to the PBX without changing the port numbers; make sure Settings > Network in 3CX shows your current public IP; and put G.711 first in the codec list on both the trunk and the provider. Calls that drop at exactly 15 minutes are a separate fault: a session-timer refresh (re-INVITE) that never arrives.
| Symptom | Most likely cause | Go to |
|---|
| One side can't hear the other | SIP ALG, RTP ports, wrong public IP | Fix 1 to 3 |
| No audio either way | RTP ports blocked, codec mismatch | Fix 2 and 4 |
| Call drops after about 30 seconds | ACK never arrives (SIP ALG or NAT) | Fix 1 and 3 |
| Call drops at exactly 15 or 30 minutes | Session timer refresh fails | Fix 5 |
| Only remote staff on the 3CX app have the problem | Port 5090 (tunnel) closed | Fix 2 |
When a call is answered, 3CX sends a 200 OK and waits for an ACK back. If the ACK never reaches it, because a router rewrote the address or the NAT mapping points somewhere else, 3CX keeps resending the 200 OK and then gives up. That retry window is about 30 seconds, which is why the drop comes at the same moment every time. In the 3CX log the line to look for is "ACK not received".
SIP ALG is a router feature that rewrites the addresses inside SIP messages. It is the most common cause of one-way audio and 30-second drops on 3CX. The 3CX firewall documentation tells you to use a router where SIP ALG can be turned off.
Run the Firewall Checker in the 3CX admin console. If it reports SIP ALG, find the setting on your router (often under Security or NAT, called SIP ALG, SIP Helper or SIP Passthrough), turn it off and restart the router. Step-by-step menus for Huawei, ZTE and MikroTik routers are in What is SIP ALG and how to turn it off.
For a 3CX server in your office, forward these to the server's private IP:
| Port | Protocol | Used for |
|---|
| 5060 | UDP (and TCP) | SIP signalling to trunks and phones |
| 5090 | UDP and TCP | 3CX tunnel for the remote apps |
| 9000-10999 | UDP | Audio (RTP) |
The external port must equal the internal one. If the Firewall Checker says something like "Mapping does not match 5060", the router is changing the port, and you need a static one-to-one (full cone) NAT rule.
3CX writes its public IP into every call so the provider knows where to send audio. If your fibre line got a new public IP after installation, 3CX keeps advertising the old one and audio goes nowhere.
In the admin console, open Settings > Network and check the public IP matches what https://ifconfig.me shows from the office. Keep STUN-based detection on, or set a static IP if your line has one.
If the trunk prefers G.729 and the provider or phone only offers G.711, calls can connect with no audio or fail with 488 Not Acceptable Here. Put G.711 U-law (PCMU) and G.711 A-law (PCMA) at the top of the codec list on the trunk and on your phones. Most providers, Sautikit included, use G.711.
Long calls send a refresh (a re-INVITE) part-way through, commonly every 15 minutes under RFC 4028 session timers. If NAT has closed the port by then, or SIP ALG mangles the refresh, the call drops at the same minute every time.
- Turn SIP ALG off (Fix 1).
- Ask your SIP provider what session-timer value they use; providers have fixed this by changing or disabling theirs.
- Avoid toggling Supports Re-invites on the trunk as a first fix; it can break music on hold and transfers.
3CX can record a packet capture from the admin console. Capture one failing call and look for:
- the
c= line in the SDP: it should show your public IP, not a 192.168.x.x address;
- whether the ACK arrives after the 200 OK;
- which codec was agreed.
Every fix above exists because the PBX sits behind an office router. If you are on 3CX mainly for a business number, extensions and staff apps, a cloud phone system skips the port forwarding entirely. Sautikit gives you a Kenyan number at KES 500 a month with free inbound calls and outbound calls at KES 3.00 a minute billed per second, plus phone apps for iPhone, Android and desktop that register straight to the cloud. If you want to keep 3CX, a Sautikit number also works as its SIP trunk on port 5080: see Connect 3CX to a Kenyan SIP trunk.
Usually because the router rewrote the audio address (SIP ALG), the RTP ports 9000-10999 are not forwarded to the PBX, or 3CX is advertising an old public IP. The fault is in the network far more often than in 3CX.
The ACK confirming the answered call never reaches 3CX, so it gives up after about 30 seconds. SIP ALG or a NAT mapping that changes ports is the usual cause. Look for "ACK not received" in the 3CX log.
UDP 5060 for SIP, UDP and TCP 5090 for the 3CX tunnel used by remote apps, and UDP 9000-10999 for audio, forwarded one to one to the PBX.
A session-timer refresh (re-INVITE) is sent mid-call and does not get through, often because of NAT timeouts or SIP ALG. Ask your provider about its session timer and turn SIP ALG off.
If 3CX runs in your office, yes: the trunk provider must be able to send audio back to it. A hosted 3CX or a cloud phone system avoids port forwarding in the office.