Ok, here's the latest on this effort from here.
I've been able to get a relatively good (well, livable at least) result by using the following values:
In the 3CX System/Security/Anti-hacking setup:
1.) "Failed Challenge Requests (407)" is set to 28. (times)
2.) "Blacklist time interval" is set to 180. (seconds)
Everything else is default.
In the 1120E config:
REG_REFRESH_INTERVAL 1500
REGISTER_RETRY_TIME 30
REGISTER_RETRY_MAXTIME 1800
SIP_PING YES
Here's the timing, as listed in the server activity log:
Code:
11-Jan-2014 15:08:45.089 [CM504001]: Endpoint Extn:851: new contact is registered. Contact(s): [sip:[email protected]:5061 / 851]
11-Jan-2014 15:06:06.852 [IPBL] Packet from banned IP/range: ip = 192.168.1.117; Comment: PBX: blocked for too many failed authentications
11-Jan-2014 15:05:06.753 Blacklisted (Too many failed auth)
IP = 192.168.1.117; Failed auth: 0; unauth: 0; auth: 0; 407: 28
11-Jan-2014 15:01:21.053 [CM504002]: Endpoint Extn:851: a contact is unregistered. Contact(s): []
11-Jan-2014 14:36:03.820 [CM504001]: Endpoint Extn:851: new contact is registered. Contact(s): [sip:[email protected]:5060 / 851]
So the endpoint hangs unregistered for seven minutes. I can live with that, but would like to see fixed firmware.....
A packet capture of the port to which ext 851 is connected shows that, after the successful registration at 15:08:45 the phone re-registers properly, with Expires set to 1500, at consistent 1470 second intervals, from then on. The trick is getting the first failover to occur quickly enough, but not to timeout the blacklist too quickly (I tried first with 120 seconds, but that didn't work, and settled on 180 seconds, which seems reliable).
So there is a workaround, even though it is a bit of a kludge.