--- title: '3CX One-Way Audio and Calls Dropping After 30 Seconds: Causes and Fixes' description: >- Fix 3CX one-way audio, no audio, and calls that drop after 30 seconds or 15 minutes: SIP ALG, RTP ports 9000-10999, public IP, codecs and session timers. summary: >- Most 3CX audio faults come from the router, not 3CX: SIP ALG, unforwarded RTP ports or a stale public IP. Here is how to find which one and fix it. date: 2026-11-05T00:00:00.000Z type: blog --- ## Summary When 3CX calls have one-way audio, no audio, or drop after about 30 seconds, the cause is almost always the network between the PBX and the outside world, not 3CX itself. Check four things in order: turn **SIP ALG** off on the router; forward **UDP 9000-10999** (audio) and **5060/5090** (signalling) to the PBX without changing the port numbers; make sure **Settings > Network** in 3CX shows your current **public IP**; and put **G.711** first in the codec list on both the trunk and the provider. Calls that drop at exactly 15 minutes are a separate fault: a session-timer refresh (re-INVITE) that never arrives. ## Which symptom do you have? | Symptom | Most likely cause | Go to | |---|---|---| | One side can't hear the other | SIP ALG, RTP ports, wrong public IP | Fix 1 to 3 | | No audio either way | RTP ports blocked, codec mismatch | Fix 2 and 4 | | Call drops after about 30 seconds | ACK never arrives (SIP ALG or NAT) | Fix 1 and 3 | | Call drops at exactly 15 or 30 minutes | Session timer refresh fails | Fix 5 | | Only remote staff on the 3CX app have the problem | Port 5090 (tunnel) closed | Fix 2 | ## Why 30 seconds? When a call is answered, 3CX sends a `200 OK` and waits for an `ACK` back. If the ACK never reaches it, because a router rewrote the address or the NAT mapping points somewhere else, 3CX keeps resending the 200 OK and then gives up. That retry window is about 30 seconds, which is why the drop comes at the same moment every time. In the 3CX log the line to look for is **"ACK not received"**. ## Fix 1: turn off SIP ALG SIP ALG is a router feature that rewrites the addresses inside SIP messages. It is the most common cause of one-way audio and 30-second drops on 3CX. The [3CX firewall documentation](https://www.3cx.com/docs/manual/firewall-router-configuration/) tells you to use a router where SIP ALG can be turned off. Run the **Firewall Checker** in the 3CX admin console. If it reports SIP ALG, find the setting on your router (often under Security or NAT, called SIP ALG, SIP Helper or SIP Passthrough), turn it off and restart the router. Step-by-step menus for Huawei, ZTE and MikroTik routers are in [What is SIP ALG and how to turn it off](/blog/sip-alg-kenya-routers). ## Fix 2: forward the right ports, one to one For a 3CX server in your office, forward these to the server's private IP: | Port | Protocol | Used for | |---|---|---| | 5060 | UDP (and TCP) | SIP signalling to trunks and phones | | 5090 | UDP and TCP | 3CX tunnel for the remote apps | | 9000-10999 | UDP | Audio (RTP) | The external port must equal the internal one. If the Firewall Checker says something like "Mapping does not match 5060", the router is changing the port, and you need a static one-to-one (full cone) NAT rule. ## Fix 3: check the public IP 3CX writes its public IP into every call so the provider knows where to send audio. If your fibre line got a new public IP after installation, 3CX keeps advertising the old one and audio goes nowhere. In the admin console, open **Settings > Network** and check the public IP matches what `https://ifconfig.me` shows from the office. Keep STUN-based detection on, or set a static IP if your line has one. ## Fix 4: match the codecs If the trunk prefers G.729 and the provider or phone only offers G.711, calls can connect with no audio or fail with **488 Not Acceptable Here**. Put **G.711 U-law (PCMU)** and **G.711 A-law (PCMA)** at the top of the codec list on the trunk and on your phones. Most providers, Sautikit included, use G.711. ## Fix 5: calls dropping at 15 minutes Long calls send a refresh (a re-INVITE) part-way through, commonly every 15 minutes under RFC 4028 session timers. If NAT has closed the port by then, or SIP ALG mangles the refresh, the call drops at the same minute every time. - Turn SIP ALG off (Fix 1). - Ask your SIP provider what session-timer value they use; providers have fixed this by changing or disabling theirs. - Avoid toggling **Supports Re-invites** on the trunk as a first fix; it can break music on hold and transfers. ## Still stuck? Capture a call 3CX can record a packet capture from the admin console. Capture one failing call and look for: - the `c=` line in the SDP: it should show your public IP, not a `192.168.x.x` address; - whether the ACK arrives after the 200 OK; - which codec was agreed. ## Or remove the office PBX from the path Every fix above exists because the PBX sits behind an office router. If you are on 3CX mainly for a business number, extensions and staff apps, a cloud phone system skips the port forwarding entirely. Sautikit gives you a Kenyan number at KES 500 a month with free inbound calls and outbound calls at KES 3.00 a minute billed per second, plus phone apps for iPhone, Android and desktop that register straight to the cloud. If you want to keep 3CX, a Sautikit number also works as its SIP trunk on port 5080: see [Connect 3CX to a Kenyan SIP trunk](/developers/guides/connect-3cx). ## FAQ ### Why does 3CX have one-way audio? Usually because the router rewrote the audio address (SIP ALG), the RTP ports 9000-10999 are not forwarded to the PBX, or 3CX is advertising an old public IP. The fault is in the network far more often than in 3CX. ### Why do 3CX calls drop after 30 seconds? The ACK confirming the answered call never reaches 3CX, so it gives up after about 30 seconds. SIP ALG or a NAT mapping that changes ports is the usual cause. Look for "ACK not received" in the 3CX log. ### Which ports does 3CX need open? UDP 5060 for SIP, UDP and TCP 5090 for the 3CX tunnel used by remote apps, and UDP 9000-10999 for audio, forwarded one to one to the PBX. ### Why do 3CX calls drop after exactly 15 minutes? A session-timer refresh (re-INVITE) is sent mid-call and does not get through, often because of NAT timeouts or SIP ALG. Ask your provider about its session timer and turn SIP ALG off. ### Does 3CX need port forwarding with a cloud SIP trunk? If 3CX runs in your office, yes: the trunk provider must be able to send audio back to it. A hosted 3CX or a cloud phone system avoids port forwarding in the office.