Firewall IP keeps getting Blacklisted

[MicroTech Global LTD]

not to worry , think we found the problem

 

[SteveITS]

A workaround is to add your IP as Allow so it won't be blocked.

Generally this means there is something triggering the block repeatedly. A partially configured phone that can't complete due to old firmware, someone entering an incorrect password, someone logging in to the management console instead of the /webclient by mistake, etc. I would think the phone would be repeatedly retrying...1-2 days sounds more like the latter two.

 

[MicroTech Global LTD]

Thanks for the update. I was thinking it was the phones after reading the full email.

I am in the process of checking all the phones.

Should i have any other issue's i will be in touch. But thank you for your response.

 

[MicroTech Global LTD]

Hi Morning

So after further investigation i have found the offending phone that is causing the problem. It has been swapped for a replacement and has been provisioned with the same extension number. All good and working.

But after a few hours the Firewall IP address is listed again and the phone in question has a different IP address and MAC address.

If you could help that would be much appreciated
.
Thank you

 

[SteveITS]

Well the MAC can’t change so that indicates a second phone… Did the one you removed get plugged in again? If it was factory reset it still would have reprovisioned unless also deleted out of 3CX. In this case the user would have multiple phones.

 

[MicroTech Global LTD]

hi, thanks for getting back to me.

The original phone was wiped and removed from the 3CX admin panel and it is just showing the Desktop app and the replacement phone now.

The IP address was removed this mornind just after lunch it has reappeared and i have managed to remove it.

So not sure what the problem is. I have provisioned a number of phones before and never had this issue.

Thanks

 

[MicroTech Global LTD]

Hi

Any further updates or help as to why our Firewall IP address keeps getting blocked.

Thanks

 

[YiannisH_3CX]

I would run a pcap on your local firewall and see what is trying to register to the public IP of the PBX. You will most probably find the culprit that way.
Make sure your phones are on the latest supported firmware.