Devices blocked during the night in remote office connected via VPN

[Massimo Bonometto]

Hi,
I have 2 Yealink W56H using the W60B base, 2 Cisco SPA 303 and one Patton 4112 gateway in a remote office.
I happens frequently that when I arrive at work in the morning I find that all, or some, of these devices stop to work during the night .
It never happens for local LAN devices.

3CX version is 15.6.15502.6

The only workaround that works for me is:
1. Patton ==> Reload configuration
2. Yealink ==> Reset Factory + Provisioning
3. Cisco ==> Reset Factory + Manual Configuration + Provisioning

I tried to wait and it seems that after a long time the Cisco SIP phones sometimes restart to work (but I'm not sure).
The block is not at extension level because if I switch on another phone previously set with the same configuration it works.
I searched in the posts but I cannot find anyone else had this kind of problem.

I played with whitelist and other settings but nothing solves the problem.

Any idea from the experts?

Thanks

Bye

 

[Saqqara]

Can you see the VPN connection dropping during the night, when you have issues.

When you say blocked, do the phones become unregistered ?

 

[eddv123]

A couple of questions:

1. Do you have any firewall rules applied to that tunnel?
2. If you Wireshark can see whether the devices are using a hostname for registration or ip address?

As a precaution on the router/firewall devices ensure any SIP helper or ALG's are enabled also.

For the Patton device as well at the very least confirm you have the default route configured:
https://www.3cx.com/voip-gateways/patton-network-configuration/

 

[Massimo Bonometto]

Yes blocked means unregistered for both phones/extension and SIP trunk (Patton).
I cannot see if the VPN drops during the night but if I try to bring it down manually it does not affect phones and Patton

 

[eddv123]

but if I try to bring it down manually it does not affect phones and Patton

This brings me back to my above point about registration. I would confirm that traffic is routing correctly - see the point(s) regarding VPN on this guide here: https://www.3cx.com/blog/docs/network-configurations-supported-3cx-phone-system/

 

[Massimo Bonometto]

I would confirm that traffic is routing correctly - see the point(s) regarding VPN on this guide here: https://www.3cx.com/blog/docs/network-configurations-supported-3cx-phone-system/

When it works everything is fine but I cannot understand why devices are disabled during the night and why a factory reset solves the problem

 

[Massimo Bonometto]

3 SIP phones disabled during lunch time. Could this log be useful?
303,304 and 329 are extensions located in remote office under the VPN

 

[Massimo Bonometto]

In this post
https://www.3cx.com/community/threads/all-extensions-getting-unregistered-frequently.47720/

I read this:

"Also it can be that your pbx is under attack, The blacklist ip needs to be put in the database and under this load, extensions may unregister because the machine has to take all its resources to the network stack because of the attack leaving 3CX without resources. This can also be the problem."

Could it be my problem? In that case, why it will not register again automatically once the attack is over? why it involves just the remote devices?

Strange world

 

[Massimo Bonometto]

Another info: I tried to switch off devices, wait for few minutes and switch them on again and they start to work again without any factory reset. NOTE: A simple restart of device usually do not solve the issue.

 

[YiannisH_3CX]

Check your blacklist and see if an IP gets blacklisted when this happens. Also you could run wireshark and see what happens with the registrations at the time of the issue.
When this happens can you access the web interface of an affected phone from the PBX machine?

 

[leejor]

If you look over the 3CX Activity Log for the previous night, is there a set time that the sets stop working (registering)? if there is a pattern, what else occurs about that time, that may be affecting the network?