Solved CALL FAILED, FORBIDDEN - Android client - External Network

[ALANB]

-------------------------------------------------------
Phone Model: ACER T03
Firmware Version: [3.10.65]

Issue Info
-------------------------------------------------------
Handset: [Phone]
Contacts: [Local|Exchange|Google]
Connection: [WiFi|3G]
Server: [Internal|External]

--------------------------------------------------------
3CX SERVER - V15.5 Beta
3CX ANDROID CLIENT 15.1.28

I have a problem with the android client when using it outside of LAN. (Note: When using the client whilst connected to internal WIFI then all works fine.)

The phone says ON HOOK and has all presence showing, but whenever I try to call a number it says CALL FAILED, FORBIDDEN.

I have TCP 5000, 5001, 443, 80 & TCP/UDP 5060, 5090 PORTS forwarded to internal IP 192.168.1.10
Firewall / Antivirus turned off
FQDN resolves to correct external IP

Any solutions to this problem?

Cheers
Alan

 

[leejor]

In the extension options, did you allow the device to register from outside the LAN?
What is the 3CX Activity Log showing? That should provide more information as to why the call is forbidden.

 

[ALANB]

Yes this extension options is not ticked so it does allow for outgoing calls and can register from outside the LAN.

MEDIUM LOG - ON REGISTRATION - REGISTERS ON HOOK and PRESENCE OK

06/24/2017 5:11:37 PM - [CM302001]: Authorization system can not identify source of: UnkSrc Recv Req SUBSCRIBE from 127.0.0.1:5080 tid=Pj57cM6jgZWGQrxve4J8UVNXHjo9va8kJs Call-ID=-K7yPxhDn8GzNn55JmBKfkp3f6vLOAOt: SUBSCRIBE sip:[email protected]:5060;transport=UDP SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5080;branch=z9hG4bK-524287-2---Pj57cM6jgZWGQrxve4J8UVNXHjo9va8kJs;rport=5080 Via: SIP/2.0/UDP 89.15.238.111:44151;branch=z9hG4bK-524287-1---tunneltid;rport;tnlid=clnt.1-znyaiajky-oxgpe0dtknfpnbn0fr.nsn Via: SIP/2.0/TCP 10.56.30.111:50195;rport;branch=z9hG4bKPj57cM6jgZWGQrxve4J8UVNXHjo9va8kJs;alias Max-Forwards: 69 Record-Route: <sip:[email protected]:5080;user=proxy;uri=clnt.1-znyaiajky-oxgpe0dtknfpnbn0fr.nsn> Contact: "Alan Bolitho"<sip:[email protected]:50195;transport=TCP;rinstance=1-znyaiajky-oxgpe0dtknfpnbn0fr.nsn;ob;inst="25265eb5"> To: "Alan Bolitho" <sip:[email protected]> From: "Alan Bolitho" <sip:[email protected]>;tag=rnQFQl.O48YPtCE2GcZprVgZICrOtW-G Call-ID: -K7yPxhDn8GzNn55JmBKfkp3f6vLOAOt CSeq: 4539 SUBSCRIBE Expires: 3600 Accept: application/simple-message-summary Supported: replaces, 100rel, timer, norefersub User-Agent: 3CXPhone for Android 15.1.41 Event: message-summary Allow-Events: presence, message-summary, refer Content-Length: 0 06/24/2017 5:11:37 PM - [CM504001]: Endpoint Extn:200: new contact is registered. Contact(s): [sip:[email protected]:50195 / 200,sip:[email protected]:5488 / 200] 06/24/2017 5:11:37 PM - Settings of Extn:200 has been updated

MEDIUM LOG - ON ATTEMPTED CALL - RETURNS CALL FAILED, FORBIDDEN

06/24/2017 5:20:41 PM - Leg L:30.1[Unknown:] is terminated: Cause: BYE from PBX 06/24/2017 5:20:41 PM - [CM502001]: Source info: From: "Alan Bolitho"<sip:[email protected]>;tag=zIbGmv9HhywIZlPgm.rWDcEsgtFQw2CS; To: <sip:[email protected];tag3cx=suomh5jq5pfcputtm0uj20s2xllmb6rh> 06/24/2017 5:20:41 PM - [CM503013]: Call(C:30): Incoming call rejected, caller is unknown; msg=Invite-IN Recv Req INVITE from 127.0.0.1:5080 tid=PjNFCwWrwdGwvmslXi9CAiSm47YRDXT0lD Call-ID=MJznzQ3cxNbpSmHKrht6IOTsBnkkdna0: INVITE sip:[email protected]:5060;transport=UDP;tag3cx=suomh5jq5pfcputtm0uj20s2xllmb6rh SIP/2.0 Via: SIP/2.0/UDP 127.0.0.1:5080;branch=z9hG4bK-524287-2---PjNFCwWrwdGwvmslXi9CAiSm47YRDXT0lD;rport=5080 Via: SIP/2.0/UDP 89.15.238.111:44151;branch=z9hG4bK-524287-1---tunneltid;rport;tnlid=clnt.1-znyaiajky-oxgpe0dtknfpnbn0fr.nsn Via: SIP/2.0/TCP 10.56.30.111:50195;rport;branch=z9hG4bKPjNFCwWrwdGwvmslXi9CAiSm47YRDXT0lD;alias Max-Forwards: 69 Record-Route: <sip:[email protected]:5080;user=proxy;uri=clnt.1-znyaiajky-oxgpe0dtknfpnbn0fr.nsn> Contact: "Alan Bolitho" <sip:[email protected]:50195;transport=TCP;inst="25265eb5";rinstance=1-znyaiajky-oxgpe0dtknfpnbn0fr.nsn;ob> To: <sip:[email protected];tag3cx=suomh5jq5pfcputtm0uj20s2xllmb6rh> From: "Alan Bolitho"<sip:[email protected]>;tag=zIbGmv9HhywIZlPgm.rWDcEsgtFQw2CS Call-ID: MJznzQ3cxNbpSmHKrht6IOTsBnkkdna0 CSeq: 10267 INVITE Session-Expires: 1800 Min-SE: 90 Allow: PRACK, INVITE, ACK, BYE, CANCEL, UPDATE, INFO, SUBSCRIBE, NOTIFY, REFER, MESSAGE, OPTIONS Content-Type: application/sdp Proxy-Authorization: Digest username="200",realm="3CXPhoneSystem",nonce="414d535c0f5ea3c911:a8aff66611feb5450e2b03e0a9b6280b",uri="sip:[email protected];transport=tcp;tag3cx=suomh5jq5pfcputtm0uj20s2xllmb6rh",response="0600bcccc88724083a7697b85d20e388",algorithm=MD5 Supported: replaces, 100rel, timer, norefersub User-Agent: 3CXPhone for Android 15.1.41 Content-Length: 383

 

[leejor]

Authorization system can not identify source of: UnkSrc Recv Req SUBSCRIBE from 127.0.0.1:5080

Incoming call rejected, caller is unknown; msg=Invite-IN Recv Req INVITE from 127.0.0.1:5080

This is the issue but not sure why it's happening. Do other remote extensions work? Are you using the Tunnel? Does it work without using the Tunnel? Did it ever work? Did you make major changes to 3CX since provisioning the phone? Have you tried re-provisioning?

 

[ALANB]

It seems as though that is the problem.

NO No extension works outside the LAN
YES I have tried with and without tunnel
NO it has never worked - except once - one call - after hundreds of attempts - then it failed again on the very next call - one minute later - with no changes to anything.
YES I have tried reprovisioning - also I have deleted the extension and then re-creating it. On multiple android handsets - None work outside the LAN - ALL work inside the LAN. I've tried WIFI in cafes / DATA on the phone and friends WIFI. None work.

PROVISIONING - WITH NO IDENTIFYING INFO
<tconfig>
<Extension>200</Extension>
<EXTGUID>REMOVED</EXTGUID>
<GCMSENDERID>REMOVED/GCMSENDERID>
<AccountName>MY NAME</AccountName>
<outboundCID>MY PHONE NUMBER</outboundCID>
<AuthID>200</AuthID>
<AuthPass>MY PASSWORD</AuthPass>
<VMAILPIN>MY PIN</VMAILPIN>
<PBXLocalAddr>192.168.1.10</PBXLocalAddr>
<PBXPublicAddr>ediag.3cx.com.au</PBXPublicAddr>
<PBXSipPort>5060</PBXSipPort>
<UseStun></UseStun>
<StunServer>ediag.3cx.com.au</StunServer>
<StunServerPort>5060</StunServerPort>
<StunServer1>stun2.3cx.com</StunServer1>
<StunServerPort1>3478</StunServerPort1>
<StunServer2>stun3.3cx.com</StunServer2>
<StunServerPort2>3478</StunServerPort2>
<Codecs>
<Codec>GSM</Codec>
<Codec>G729</Codec>
<Codec>PCMU</Codec>
<Codec>PCMA</Codec>
<Codec>G722</Codec>
</Codecs>
<Voicemail>MY VOICE MAIL NUMBER</Voicemail>
<SIPTransport>0</SIPTransport>
<RTPTransport>0</RTPTransport>
<DtmfRFC2833>1</DtmfRFC2833>
<DtmfInband>0</DtmfInband>
<DtmfSipinfo>0</DtmfSipinfo>
<DtmfPayload>101</DtmfPayload>
<RegistrationTime></RegistrationTime>
<UseTunnel>1</UseTunnel>
<TunnelPort>5090</TunnelPort>
<TunnelPass>MY TUNNEL PASSWORD</TunnelPass>
<UseProxy></UseProxy>
<ProxyAddr></ProxyAddr>
<ProvLink>https://192.168.1.10:5001/provisioning/0cqjzu0qmahiq/TcxProvFiles/3cxProv_170622055023_200.xml</ProvLink>
<ProvLinkExternal>https://ediag.3cx.com.au:5001/provisioning/0cqjzu0qmahiq/TcxProvFiles/3cxProv_170622055023_200.xml</ProvLinkExternal>
<MyPhoneServerLocalAddr></MyPhoneServerLocalAddr>
<MyPhoneServerPublicAddr></MyPhoneServerPublicAddr>
<MyPhoneServerLocalSSLAddr>https://192.168.1.10:5001/myphone/MPWebService.asmx</MyPhoneServerLocalSSLAddr>
<MyPhoneServerPublicSSLAddr>https://ediag.3cx.com.au:5001/myphone/MPWebService.asmx</MyPhoneServerPublicSSLAddr>
<UseCTI>false</UseCTI>
<ReprovisionOnStartup>0</ReprovisionOnStartup>
<StartUpScreen>0</StartUpScreen>
<CryptoVersion>0</CryptoVersion>
<ConfigVersion>2</ConfigVersion>
</tconfig>

 

[ALANB]

I should also point out that INCOMING CALLS are fine

 

[leejor]

Given the fact that you report multiple remote sets failing, It suggests either a firewall (or some other hardware) issue, or, when you first set-up the PBX there was something incorrect put in one of the settings, that is being passed on in the provisioning files. Have you ever tried a 3CX Windows client?

 

[ALANB]

Given the fact that you report multiple remote sets failing, It suggests either a firewall (or some other hardware) issue, or, when you first set-up the PBX there was something incorrect put in one of the settings, that is being passed on in the provisioning files. Have you ever tried a 3CX Windows client?

Interesting suggestion, the windows clients on the computers all work fine but they are all internal on the net. I will set up one of the mobiles as an internet point and tether the laptop to it to see if that helps.

One moment......brb

 

[ALANB]

OK the windows client when tethered to an outside network also failed with call failed, forbidden message. Perhaps I should backup and reinstall and see if that works. any suggestions

 

[YiannisH_3CX]

Navigate to settings / network / FQDN and check that your local SIP domain matches your FQDN. Let us know if that resolves your issue

 

[ALANB]

Frustration solved: It made several outgoing calls under various conditions. Internal network use and external network use and all work perfectly. Presence showing and receives incoming calls from extensions and from outside the network and internal. Firewall and antivirus are active. Call quality good.

HISTORY: I was unable to make calls to phone numbers when using android client from outside the network. However, receiving calls was fine from both internal and external of the network both from extensions and external numbers.

SOLUTION: SETTINGS >> NETWORK >> FQDN. Local SIP and FQDN must be the same. (In my case the Local SIP was empty)

Thank you to all that assisted with the problem and Yiannis for providing the solution.

 

[YiannisH_3CX]

Glad the issue was resolved