IT Toolbox
IT Toolbox

3CX / VoIP Center

3CX / SIP / VoIP

3CX / VoIP Center

Guided diagnostics for SIP trunks, phones, DECT, NAT, SBC, audio, certificates and voice quality.

NetworkTest PBX HTTPS
Test-NetConnection <PBX> -Port 443
NetworkTest 3CX tunnel
Test-NetConnection <PBX> -Port 5090
SIPTest SIP port
Test-NetConnection <SIP_FQDN> -Port 5060
DNSResolve PBX
nslookup <PBX_FQDN>
QualityPing 50 packets
ping <PBX> -n 50
QualityPathping
pathping <PBX>
Windows3CX/SBC services
Get-Service | Where-Object {$_.Name -match '3CX|SBC'}
WindowsUDP ports
Get-NetUDPEndpoint
SMTPMicrosoft 365 SMTP
Test-NetConnection smtp.office365.com -Port 587

VoIP quality assessment

1

SIP ≠ RTP

Signaling can work while audio still fails.

2

NAT

Check the public IP, required ports and SIP ALG.

3

QoS

Prioritize voice when WAN bandwidth is constrained.

4

DECT

Firmware and radio coverage matter as much as the IP network.

5

Certificates

Correct system time and DNS are essential for TLS.

6

Backup

Test your backups before a major migration.

Warning: ports and behavior vary by 3CX version, hosting mode and SIP provider.
Field troubleshooting

Center mission

8 playbooks

Separate SIP registration, call routing, trunk, NAT/RTP, queues and DECT to avoid simultaneous changes on PBX, phone and firewall.

Quick triage

  • Define inbound, outbound, internal or transfer call and note exact time.
  • Confirm extension and trunk status in 3CX.
  • Compare another extension and number on the same flow.
  • For audio, check RTP/NAT separately from SIP signaling.
  • For DECT, separate W90/W80 registration from radio coverage.

Decision tree

Phone not registered→

Troubleshoot network/provisioning/credentials before call rules.

Signaling works but no audio→

Prioritize RTP, NAT, firewall and advertised IPs.

All external calls fail→

Check trunk, routes and carrier status.

Only one queue/transfer scenario fails→

Analyze queue strategy, permissions and agent state.

Intervention playbooks

Start read-only, collect evidence, then change one variable at a time.

01Phone not registeredRead-only
Symptom

Phone shows unregistered or extension is red in 3CX.

Checks

  • Check IP, DNS and access to 3CX FQDN.
  • Check provisioning, MAC and SIP credentials.
  • Compare phone firmware and time.

Commands / evidence

ping <3CX_FQDN>nslookup <3CX_FQDN>Test-NetConnection <3CX_FQDN> -Port 443

Expected result

Phone reaches server, retrieves provisioning and extension becomes Registered.

Corrective actions

  • Fix DNS/provisioning before factory-resetting phone.
  • Reassign MAC only if the device is actually replaced.

Escalate when

Multiple phones unregister, SBC/tunnel is down or PBX is unreachable.

02Inbound calls do not ringRead-only
Symptom

External number gets busy/voicemail or no user rings.

Checks

  • Check trunk and received DID.
  • Check inbound rule, office hours and destination.
  • For queues, check logged-in agents and strategy.

Commands / evidence

nslookup <3CX_FQDN>ping <SIP_PROVIDER>Test-NetConnection <SIP_PROVIDER> -Port 5060

Expected result

Call appears in 3CX logs and follows inbound rule to an available destination.

Corrective actions

  • Fix DID/rule/hours according to break point.
  • Test with a real number after each change.

Escalate when

Call never reaches 3CX or carrier trunk does not present expected DID.

03Outbound calls failRead-only
Symptom

Internal calls work but external calls fail or return a SIP code.

Checks

  • Read SIP code and selected outbound route.
  • Check prefix, length and E.164 format.
  • Check trunk, channel limit and authentication.

Commands / evidence

ping <SIP_PROVIDER>Test-NetConnection <SIP_PROVIDER> -Port 5060nslookup <SIP_PROVIDER>

Expected result

Rule matches and trunk accepts INVITE without authentication or number-format rejection.

Corrective actions

  • Fix route or number format rather than changing all trunks.
  • Compare a successful and a failed call.

Escalate when

Persistent carrier codes, blocked trunk or global dialing-plan change.

04One-way audio / no audioRead-only
Symptom

Call establishes but only one side hears audio or no media passes.

Checks

  • Separate established SIP from missing RTP.
  • Check NAT, RTP ports and advertised public IP.
  • Compare LAN, external and SBC scenarios.

Commands / evidence

ping <remote_gateway>tracert <remote_gateway>netstat -ano | findstr UDP

Expected result

RTP flows in both directions between correct IPs/ports.

Corrective actions

  • Fix NAT/firewall/SBC according to missing RTP direction.
  • Avoid SIP ALG unless 3CX architecture requires it.

Escalate when

Carrier NAT, double NAT or third-party firewall requires simultaneous capture.

05Queue does not distribute callsControlled change
Symptom

Calls stay queued or skip agents that appear available.

Checks

  • Check logged-in agents, status and permissions.
  • Check queue strategy and already-on-call agent option.
  • Read timeout, no-answer destination and office hours.

Commands / evidence

ping <3CX_FQDN>nslookup <3CX_FQDN>

Expected result

An eligible agent is selected according to strategy and the endpoint rings.

Corrective actions

  • Fix membership/status/strategy then test with two agents.
  • Document any queue-behavior change.

Escalate when

Complex call-center logic, reporting mismatch or behavior appeared after update.

06Transfer or second call failsControlled change
Symptom

Hold, attended transfer or second call fails in a specific scenario.

Checks

  • Compare internal, direct and queue-originated calls.
  • Check extension permissions and phone capabilities.
  • Check queue/ring-group behavior for busy agents.

Commands / evidence

ping <PHONE_IP>Test-NetConnection <PHONE_IP> -Port 443

Expected result

Scenario is reproducible and limitation is attributed to endpoint, permissions or queue logic.

Corrective actions

  • Change only the necessary queue setting or permission.
  • Validate expected behavior with user before broader change.

Escalate when

Product/version limitation, unsupported phone or requirement conflicts with 3CX behavior.

07DECT — registration or coverageControlled change
Symptom

Handset not registered, disconnects, crackling or drops by location.

Checks

  • Check DECT manager/base online and consistent firmware.
  • Separate registration issue from RF issue.
  • Test same handset near another base.

Commands / evidence

ping <W90_OR_BASE_IP>arp -aTest-NetConnection <W90_OR_BASE_IP> -Port 443

Expected result

Handset remains registered and quality is stable in covered area.

Corrective actions

  • Fix provisioning/firmware for registration; coverage/placement for RF.
  • Do not move multiple bases at once.

Escalate when

Multi-cell sync is unstable, structural coverage is insufficient or interference persists.

08SIP trunk downIntrusive / escalation
Symptom

Trunk is unregistered or all external calls are unavailable.

Checks

  • Check carrier DNS/IP and network connectivity.
  • Read registration/IP-based state and SIP codes.
  • Check public IP, firewall or carrier changes.

Commands / evidence

nslookup <SIP_PROVIDER>ping <SIP_PROVIDER>Test-NetConnection <SIP_PROVIDER> -Port 5060

Expected result

Trunk is Registered/Available and inbound/outbound test call succeeds.

Corrective actions

  • Fix connectivity or authentication according to trunk mode.
  • Keep SIP codes and timestamps for carrier.

Escalate when

Carrier outage, IP block, SBC change or general call unavailability.

End-of-intervention checklist

  • Test inbound, outbound and internal calls within scope.
  • Validate two-way audio.
  • Check extension/trunk/agents after change.
  • Record time and number of validation calls.
  • Document changed rule, queue, trunk or device.

Continue in BAOI

Related cheat sheetWindows network — VoIP checks IT toolsCalculate, inspect or generate without leaving the workflow. ProceduresFollow a controlled implementation procedure. Known failuresCross-check the symptom with known failure patterns.
♡ 0