Direct SIP (STUN) phone randomly loses registration

[Michael Menor]

We have one extension with the "Direct SIP (STUN - remote)" provisioning method. The phone is a Grandstream GXP-2140. From time to time the phone will go "unregistered" and the only resolution is to perform the following:

1. In 3CX Mgmt Console, edit the Phone Provisioning settings
2. Change the "Local SIP Port of the Phone" to a different port (I will usually swap between port 5065 and 5062)
3. Wait for the "RPS request" to show up in the Event Log
4. Reboot the phone and then it will return as "Registered" and it functions normally

System configuration:

• 3CX v16 SP3 (16.0.3.676)
• Grandstream firmware: we have tried the currently supported 3CX version (1.0.9.135) and have also tried v1.0.11.2

My questions to the group are:

• Why does this consistently happen?
• Has anyone else ran into this issue?

 

[eddv123]

Mostly every issue with STUN phones are related to firewall or network settings, however it is commonly said with 3CX that STUN is OK for 1-2 phones per site (anymore it is recommended to have an SBC or VPN.

In anycase we have some sites with more, so ensure that there are port forwarding rules in place for the SIP and RTP ports on the firewall to the endpoint - and the endpoint has its own static or statically assigned IP address.

Attached is a firewall setup/flow example I wrote for Draytek.

 

[eddv123]

Also ensure you have SIP ALG disabled as well on the firewall.

 

[Michael Menor]

@eddv123 - Thanks for the quick reply! This is the only remote extension for this PBX. I have confirmed that "SIP ALG" is disabled on both routers.

I will need to look into port forwarding the "Local SIP" port to that phone.

 

[eddv123]

It should'nt be required really for a single port, but I would still do it. Do one single port forwarding rule to the local IP of the phone, add the ports used by the phone/3CX and ensure the IP is static.

What brand is the local firewall onsite ?

 

[Michael Menor]

Both ends have FortiGate firewalls.

 

[eddv123]

I have found those (as well as Watchguard, Sonicwall, and Meraki) to be real pains for VoIP in the past so have found building VPN's to be the best option. A bit overkill for a single phone I know.

You might want to check over the firewall for SIP related settings that may effect the packets:

https://help.fortinet.com/fos50hlp/...ate-voip-guide-52/sessionhelper-disenable.htm

https://help.fortinet.com/fos50hlp/...ate-voip-guide-52/Common-config-fortigate.htm

https://kb.fortinet.com/kb/documentLink.do?externalID=FD36405

 

[JohnS_3CX]

Hi Michael,

That procedure should not be necessary, but if you see no registration attempts coming in from the phone by simply rebooting it, you are probably facing firewall issues.

As mentioned above, forwarding the ports directly to the phone (SIP+RTP) should solve this issue.

Note: The RPS request does nothing more but inform the Grandstream RPS server of the provisioning link so it has no effect in this case on the PBX or the phone itself. If it did, the phone would be asking for login credentials which I imagine is not happening in your case.

 

[eddv123]

That procedure should not be necessary

Agreed, but I have found it an easier work-around in the past when dealing with overally secure firewalls and/or 3rd party IT companies who cant seem to get the configuration right.

 

[drewt]

Raspi as SBC works well for my customers, as it shows as a trunk in the sip section it can notify you when its status changes, and its cheap. Really takes the risk of unfriendly firewalls out of the equation. Yealink phones support 2 proxy setttings, so I always run a backup on site as well. With out an sbc your just one firewall rules update/refresh/reset away from loss of service.

 

[JohnS_3CX]

Agreed, but I have found it an easier work-around in the past when dealing with overally secure firewalls and/or 3rd party IT companies who cant seem to get the configuration right.

Oh I was referring to the 1-2-3-4 steps he mentioned, but if you were referring to the opening of ports then that is absolutely necessary if our goal is stability.

 

[eddv123]

Oh I was referring to the 1-2-3-4 steps he mentioned, but if you were referring to the opening of ports then that is absolutely necessary if our goal is stability.

No I was referring to the my comment about VPN setup