Forbidden Calls

[beneal86]

Our system has been working fine for years but suddenly we have a very strange issue where for periods throughout the day all outgoing call attempts received the error:

Call or Registration to <external no.>@(Ln.10001@Gamma) has failed. <Gamma IP> replied: 403 Forbidden-Source Endpoint Lookup Failed; from IP:<Gama IP>:5060

The weirdest thing is that the issue is resolved when an inbound call is received and outgoing calls can then be made fine. However, if the lines are quiet for a while the problem returns. I'm sure this is down to firewall config but we have a hosted solution and our providers are claiming nothing has changed and everything is set up correctly.

Any ideas?

 

[robert.taylor]

Ask Gamma if they can do a trace and check that your firewall is natting the system correctly. That looks like the IP your system is supplying to Gamma is incorrect so they are blocking it

 

[beneal86]

Ask Gamma if they can do a trace and check that your firewall is natting the system correctly. That looks like the IP your system is supplying to Gamma is incorrect so they are blocking it

Thanks @robert.taylor - I thought that too so logged a ticket with Gamma yesterday, just haven't heard back yet. I can't see any issues wtih captures I've done internally so I'm sure the firewall is ruining it. It's just really odd that it can work fine for a while after an incoming call..

 

[robert.taylor]

Ask them to check there is a static nat for both inbound and outbound traffic

 

[beneal86]

Our provider says static NAT is configured for both inbound and outbound. Gamma can't see the failed calls hitting the endpoint SBC, so are assuming it's rejecting the call as it's receiving it from its own IP address, so the firewall must be doing something odd. They did turn on SIP ALG for a while which seemed to sort the issue but we then had no audio on incoming calls. We're really struggling with this so if anyone has any pearls of wisdom I'd be really grateful!

 

[ClaudioBassani]

Hi, I bring you my experience. The same problem happened to me that I solved by configuring the NAT Keep alive parameter on the internet router for a value of about 5 minutes. I think the same value configured in 3CX Console-> Settings-> Firewall-> Enable Keep Alives is fine too, but I haven't tried as the configuration on the router worked fine. My system is an on premise 3CX PBX

 

[YiannisH_3CX]

Call or Registration to <external no.>@(Ln.10001@Gamma) has failed. <Gamma IP> replied: 403 Forbidden-Source Endpoint Lookup Failed; from IP:<Gama IP>:5060

If you are still seeing this then it sounds odd to me that the calls are not hitting their SBCs since you are clearly getting a reply back from that IP.

The weirdest thing is that the issue is resolved when an inbound call is received and outgoing calls can then be made fine

This is also a bit odd as firewalls usually work the other way around. They block inbound traffic until an outbound call is made which enabled the connection.

Try something and let us know of the results. Run a firewall checker test at a time the calls are working (make sure there are no active calls as they will be dropped) and let us know of the result. Then wait for calls to stop working and run the firewall checker again. See if you get different results.

 

[beneal86]

Thanks for your advice.
The firewall checker fails with the following:

3CX SIP Server
testing port 5060... Mapping does not match 5060. Mapping is 65476.
3CX Tunelling
testing port 5090... Mapping does not match 5090. Mapping is 65506.

All of the full cone tests fail.

This is identical when the calls are working and when they aren't. However.. this has always been the case since moving to this ISP and since calls were working ok they weren't interested in looking into why.

 

[YiannisH_3CX]

For the PBX to work correctly and be sure that its not a firewall configuration issue the firewall checker should pass, especially when troubleshooting an issue related to firewall problems.
I would recommend forwarding all the necessary ports and running the firewall checker again. Once the firewall checker passes try to replicate the issue and we will take it from there.