The call connects and SIP signaling succeeds, but one participant cannot hear the other. This usually points to a media-path problem involving RTP/SRTP, NAT, a firewall, endpoint routing or the address negotiated in SDP.
Likely causes
- Incorrect NAT or firewall rules for media traffic
- Blocked RTP ports or misrouted return traffic
- SIP ALG rewriting signaling unexpectedly
- Incorrect media IP address or port advertised in SDP
- An unreachable 3CX SBC, remote network route or endpoint
Diagnostic checks
- Identify the affected direction: record who can hear whom, the timestamp and the two extensions or telephone numbers.
- Compare internal, inbound and outbound calls, then test one wired phone and one app to isolate endpoint or trunk-specific behavior.
- Check SIP signaling and the negotiated media addresses; confirm RTP/SRTP packets arrive in both directions.
- Review firewall/NAT policies, remote SBC connectivity and whether SIP ALG is interfering with 3CX traffic.
- Run 3CX Firewall Checker when the PBX and deployment topology require it; compare results with the official port requirements.
Possible fixes
- Correct only the relevant firewall and NAT rules for the actual 3CX configuration and trunk provider.
- Use valid announced public and private addresses and verify the return route for voice packets.
- Disable SIP ALG or similar helpers when they interfere with the 3CX deployment, following vendor guidance.
- Check SBC, remote DECT base and VPN paths when the issue is limited to a site or device group.
- Retest calls from both ends and confirm audio, not only successful call setup.
When should you escalate?
Escalate if the symptom is intermittent or spans several sites. Provide a precise call time, caller and recipient, affected endpoint, relevant logs and—if authorized—SIP/SDP and RTP captures. Remove sensitive account data and telephone numbers before sharing logs externally.