DP750/720 with STUN

[VISA MC]

In our office we have 2 2160’s and a DP750/720 combo and we’re using all 3 with no issues.
Last night we swapped our router for a Ubiquiti Security Gateway and the 2160’s are both working fine but the 750 will not accept incoming calls. It shows as timeout in the logs. I did notice when I go to the phones tab it shows a local IP where my 2160’s show our WAN IP.
Our pbx is hosted in AWS and we do not use an SBC.

my question is what could have changed to break this phone? Is there a way to use STUN with phones that are not provisioned by 3CX? What is everyone’s go to for cordless phones? All of ours in the field are grand streams and always have some sort of issue.

 

[Evolute IT]

In our office we have 2 2160’s and a DP750/720 combo and we’re using all 3 with no issues.
Last night we swapped our router for a Ubiquiti Security Gateway and the 2160’s are both working fine but the 750 will not accept incoming calls. It shows as timeout in the logs. I did notice when I go to the phones tab it shows a local IP where my 2160’s show our WAN IP.
Our pbx is hosted in AWS and we do not use an SBC.

my question is what could have changed to break this phone? Is there a way to use STUN with phones that are not provisioned by 3CX? What is everyone’s go to for cordless phones? All of ours in the field are grand streams and always have some sort of issue.

Make sure the DP750 uses the FQDN and that it has different local SIP port and RTP ports than the 2160.

Also, check the new firewall to be sure that port forwards (each SIP port and RTP range) and static IPs are set for each device.

Example:

• 2160 #1 -> SIP 5065, RTP 14001-14019, IP 192.168.2.5
• 2160 #2 -> SIP 5075, RTP 14101-14119, IP 192.168.2.10
• DP750 -> SIP 5085, RTP 14201-14219, IP 192.168.2.15

 

[VISA MC]

Thanks! On the 750, I do not have a phone provisioned in 3CX for it so it doesn’t give me an RTP or SIP port option. Should I just set that in the phone itself then forward ports?

 

[Evolute IT]

Thanks! On the 750, I do not have a phone provisioned in 3CX for it so it doesn’t give me an RTP or SIP port option. Should I just set that in the phone itself then forward ports?

On the base web UI itself it can be modified. Under Settings -> Network if my memory serves. And yes, then forward.

The SIP/RTP ports option in 3CX is simply to ease config of multiple devices with the templates, that's all that does.

 

[VISA MC]

That worked! Calls are now completing to that extension. Thank you. One last followup:

I am leery of opening the firewall to the whole world, so I could in theory limit traffic from the IP of our AWS instance to 5070 (SIP port I am using for the cordless) or do you think the setting in the phone of Accept Incoming SIP from Proxy Only is sufficient enough to not get junk calls and fake triggers?

 

[Evolute IT]

That worked! Calls are now completing to that extension. Thank you. One last followup:

I am leery of opening the firewall to the whole world, so I could in theory limit traffic from the IP of our AWS instance to 5070 (SIP port I am using for the cordless) or do you think the setting in the phone of Accept Incoming SIP from Proxy Only is sufficient enough to not get junk calls and fake triggers?

The "Accept Incoming SIP from Proxy Only" is already a good start. However, if you have a static IP, I'd say yes, limit the traffic source to your PBX WAN IP.

For the best security, use a VPN or the SBC. The SBC uses only 1 port outgoing so no port forwarding required. Only a small always-on PC or Raspberry Pi.

 

[VISA MC]

On the DP750, I only see an option for a single RTP port for each profile. I left that at 5004, 6004, 7004 and 8004. I am seeing a Proxy Authentication Required in the PCAP, but I'm not sure that would be causing the timeouts. Am I missing anything else or should I rip these out and move to something that can be provisioned directly in 3CX?

 

[Evolute IT]

On the DP750, I only see an option for a single RTP port for each profile. I left that at 5004, 6004, 7004 and 8004. I am seeing a Proxy Authentication Required in the PCAP, but I'm not sure that would be causing the timeouts. Am I missing anything else or should I rip these out and move to something that can be provisioned directly in 3CX?

When using STUN, the RTP port is only important for port forwarding.

3CX includes this option in their template to ease deployment of many handset at the same site.

 

[VISA MC]

Hmmm I’m not sure my STUN is properly set up as I don’t have a template. Only forwarded the ports and registered the phones. I thought I read somewhere STUN can’t be used without a supported phone on 3CX.

 

[Evolute IT]

Hmmm I’m not sure my STUN is properly set up as I don’t have a template. Only forwarded the ports and registered the phones. I thought I read somewhere STUN can’t be used without a supported phone on 3CX.

RPS cannot. STUN can.

Normally, even without 3CX provisioning, you can do this:

• Phone 1 : SIP 5060, RTP 14001
• Phone 2 : SIP 5065, RTP 14101
• Phone 3 : SIP 5070, RTP 14201
• and so on

The 3CX Provisioning only makes it easier for you. Without it, you need to manually set these on the phone, then port forward each to the IPs of devices.

 

[VISA MC]

I am seeing a Proxy Requires Authentication in my pcaps but the install with 4 phones will work for a couple hours then stop working and get timeouts again. I have a ubiquiti security gateway installed at that location with RTP ports and SIP ports forwarded to the base station.
My pcaps don’t look any different when I have STUN enabled or not. I’m not sure what I am doing wrong.
I’m wondering if it’s time to pull these and put in something supported.

 

[Evolute IT]

I am seeing a Proxy Requires Authentication in my pcaps but the install with 4 phones will work for a couple hours then stop working and get timeouts again. I have a ubiquiti security gateway installed at that location with RTP ports and SIP ports forwarded to the base station.
My pcaps don’t look any different when I have STUN enabled or not. I’m not sure what I am doing wrong.
I’m wondering if it’s time to pull these and put in something supported.

Why not use an SBC? It should fix all these issues. Even without "official support", simply put the SBC IP in Outbound Proxy and you're good to go.

 

[VISA MC]

Here is the error we get. This starts to happen about an hour after reboot. This is from the 3CX activity log. The phones are registered on 5080, 5081, 5082 and 5083 so I almost wonder if 5060 is where the issue is coming from on the server side.

 

[VISA MC]

Why not use an SBC? It should fix all these issues. Even without "official support", simply put the SBC IP in Outbound Proxy and you're good to go.

I will try that as well. I've just never seen these issues and we did not have them on the old provider. All we had to put in was the SIP server, SIP port and authentication credentials. Here is what I have done on these 4 phones.

Phone 1 - SIP 5080 - RTP 5004
Phone 2 - SIP 5081 - RTP 6004
Phone 3 - SIP 5082 - RTP 7004
Phone 4 - SIP 5083 - RTP 8004

I have the 3cx FQDN in the SIP server and the authentication credentials are in the auth ID, username and password fields. Aside from these, everything else is in it's factory default state.

As for network, all above ports are forwarded to the IP of the base station.


When I look at the PCAP, it shows port 5089, which is not what the local SIP port is for that extension, or any of them for that matter.

 

[Evolute IT]

I will try that as well. I've just never seen these issues and we did not have them on the old provider. All we had to put in was the SIP server, SIP port and authentication credentials. Here is what I have done on these 4 phones.

Phone 1 - SIP 5080 - RTP 5004
Phone 2 - SIP 5081 - RTP 6004
Phone 3 - SIP 5082 - RTP 7004
Phone 4 - SIP 5083 - RTP 8004

I have the 3cx FQDN in the SIP server and the authentication credentials are in the auth ID, username and password fields. Aside from these, everything else is in it's factory default state.

As for network, all above ports are forwarded to the IP of the base station.


When I look at the PCAP, it shows port 5089, which is not what the local SIP port is for that extension, or any of them for that matter.
View attachment 12087

At this point, I really suggest you read the manual of the DP75x for any other references to the SIP port. I know there are 2-3 on this device.

Even then, I still recommend you setup an SBC. If your phones are all on the same server and just needs extension per-handset, you can try asking Grandstream for their 3CX template of that device. If you're a reseller or partner of them, they will give it to you pretty quickly. It's an FXS template tho so it needs to be uploaded manually.

 

[VISA MC]

I looked in the manual and touched every menu on the interface and the only reference to SIP ports are on each profile. I have 4 profiles setup, so there is an option for SIP port on each page, but that is all. I have also reached out to Grandstream for help here.

So you are saying if I install the SBC on a computer on their LAN, the only change that needs to be made is the outbound proxy should be set to the local IP, the SIP and RTP ports stay where they are now?

 

[Evolute IT]

I looked in the manual and touched every menu on the interface and the only reference to SIP ports are on each profile. I have 4 profiles setup, so there is an option for SIP port on each page, but that is all. I have also reached out to Grandstream for help here.

So you are saying if I install the SBC on a computer on their LAN, the only change that needs to be made is the outbound proxy should be set to the local IP, the SIP and RTP ports stay where they are now?

When using the SBC, factory reset the DP750 to make sure all are defaults ports. Different ports are not necessary for SBC.

Also, check under Network settings, I remember there's a setting to set as "Send to proxy: Always".

 

[VISA MC]

Calls are completing, but the ports on PCAPs are still showing strange numbers, not the numbers in the settings, nor the port number for the SBC. Also when I called the location, there was a noticeable delay in the person responding to my questions.

I am trying to get somewhere with grandstream to figure out why the phone is ignoring the SIP port that is programmed in there.

 

[Evolute IT]

After installing the SBC and performing a PCAP on the phone, I am still getting the same exact error, proxy authentication required, but then right below it is status OK. The only thing different now is it seems to be registering to the SBC, not to the IP of the cloud instance.

Calls are completing, but the ports on PCAPs are still showing strange numbers, not the numbers in the settings, nor the port number for the SBC. Also when I called the location, there was a noticeable delay in the person responding to my questions.

Did you factory reset the phone?

Also, I'd recommend waiting for Grandstream to send you their template. I use it here for my DP752 and it just works.

By the way, are you using the latest firmware? (1.0.9.9)

 

[VISA MC]

Did you factory reset the phone?

Also, I'd recommend waiting for Grandstream to send you their template. I use it here for my DP752 and it just works.

By the way, are you using the latest firmware? (1.0.9.9)

Yes the phone is factory reset. I am unable to configure it from 3CX. I only input the credentials for each extension into the profiles on the DP750 and the IP of the SBC. Extensions are registered and calls are completing, but there is a horrendous delay now. Grandstream has replied a couple of times, but aren't giving up their template very easily. Thanks for your help!