3CX v20: SIP denies registering through one of ISP provider

[VUSALDADASHOV]

Hello Dear forum

Really need your help to show mw the way to troubleshoot. I'm facing with this kind of isse for the first time.

Look. I have a Fortigate device which has 2 ISP providers. Those network interfaces (WAN1 & WAN2) configured as SDWAN Interface and named as VirtualWanLink. SDWAN does his job. I’m sure. I have many IPSEC connection (all of them are dual) and a everything seems to work.

So, What is the case

• WAN1 IP: 1.1.1.1
• WAN2 IP: 2.2.2.2

BTW, I noticed this issue today. When in the afternoon today WAN2 had internet outage, 2 of my SIP trunks just stopped working. Those SIP trunks are connected through internet: public IP address, resolvable FQDN.

So, briefly those t2o trunks didn’t want to register via 1.1.1.1. After 2 hours Provider fixed his issue and all start to work. In the evening, before I left the office, I made some tests. I disabled WAN2 interface (2.2.2.2) and saw that those 2 trunks were red.

I started troubleshooting

• Ping to voip provider: OK
• Telnet to voip provider 5060: OK
• Nslookup voip provider FQDN: resolved correct IP address.

But SIP trunk denied to register!!!



I thought that SIP Provider blacklisted my WAN1 IP address (1.1.1.1) What did to check it?!

I disabled those two trunks. I downloaded and installed MicroSIP application onto my computer. My computer also passed all network related tests and I had internet through WAN1 (1.1.1.1) interface.

But MicroSIP registered this SIP account successfully. That means SIP provider didn’t blacklisted my IP. I’m sure.

Wireshark shows register logs. All seems are OK… But trunk doesn’t want to register

What else can I do ??

PS: in the past this worked. I’m sure! But this issue may persists for a long time… I just noticed it today

 

[TheodorosG_3CX]

Did you Flush the DNS cache on the machine?

 

[VUSALDADASHOV]

Did you Flush the DNS cache on the machine?

I've rebooted pbx twice. As you know reboot flushes DNS
I have no issue with DNS

 

[TheodorosG_3CX]

There is no need to reboot the server as you can flush the DNS from the CLI and try to restart the PBX services.
Also have you checked the supported network configurations?

 

[OlegR_3CX]

@VUSALDADASHOV
Good morning.
When the issue is there, if you run the .pcap capture on the server, and then filter in the Wireshark with :

sip.CSeq.method =="REGISTER"
or
sip and ip.addr==1.1.1.1 (your trunk provider IP)

Do you see one-way traffic, does the provider reply to the PBX or does the PBX send anything to the provider? You could review the contact information there, and the IP addresses used.

 

[VUSALDADASHOV]

There is no need to reboot the server as you can flush the DNS from the CLI and try to restart the PBX services.
Also have you checked the supported network configurations?

i know, just did it to be sure.

 

[VUSALDADASHOV]

sip and ip.addr==1.1.1.1

@VUSALDADASHOV
Good morning.
When the issue is there, if you run the .pcap capture on the server, and then filter in the Wireshark with :

sip.CSeq.method =="REGISTER"
or
sip and ip.addr==1.1.1.1 (your trunk provider IP)

Do you see one-way traffic, does the provider reply to the PBX or does the PBX send anything to the provider? You could review the contact information there, and the IP addresses used.

I see one way traffic. No reply from provider

 

[TheodorosG_3CX]

You need to check this with captures and filter accordingly to check where packets are routing or any responses from/to the PBX.

 

[TheodorosG_3CX]

Do those Registrations reach the provider?

 

[OlegR_3CX]

Great, now if you see the information that the 3CX system sends, does it have a different IP in there to where the provider should reply?

 

[OlegR_3CX]

Also, do the same capture on the Firewall directly, and see if the provider replies but it's then not reaching the 3CX system due to the routing/networking issue.

 

[VUSALDADASHOV]

You need to check this with captures and filter accordingly to check where packets are routing or any responses from/to the PBX.

Thanks. This was a first thing I made

Do those Registrations reach the provider?

Actually yes/

 

[VUSALDADASHOV]

Also, do the same capture on the Firewall directly, and see if the provider replies but it's then not reaching the 3CX system due to the routing/networking issue.

I can do it only after work hours.

 

[OlegR_3CX]

Perfect, as this should give you a better picture of the issue you have.

 

[VUSALDADASHOV]

I have just disanled 2.2.2.2 again. Run capture both on PBX and on forewall


I verified that I reach SIP Provider host through 1.1.1.1




DATA

Received Bytes	0 B
Received Packets	0
Sent Bytes	60 B
Sent Packets	1

Here is pcap from directly from PBX


Again, I'm sure that this traffic is NATted through 1.1.1.1 (WAN1 interface)
BUT
I cant see that SIP Provider wants me to reach. There are no attempts to reach 1.1.1.1 from SIP Provider IP (81.21.80.178)
Normally, SIP Provider have to reach my PBX's udp/5060

So that means either my IP is blacklisted on SIP Provider side or there any other issue on ISP proder side?
Am I correct ?

 

[VUSALDADASHOV]

But what really confuses me, is that even now I am able to register that trunk from my work PC (when WAN2 interface disable and all my internet connection goes through 1.1.1.1)
That really confuses me....

 

[TheodorosG_3CX]

So that means either my IP is blacklisted on SIP Provider side or there any other issue on ISP proder side?

It seems that this can be the case. Have you also checked with the ISP?

 

[OlegR_3CX]

If it can help you see the network flow, you could compare the traffic from the 3CX system to the one that you mention you use when registering with your PC as a test.

 

[VUSALDADASHOV]

It seems that this can be the case. Have you also checked with the ISP?

Im talking with them
anyway guys thank you for help

 

[TheodorosG_3CX]

You are welcome