HT8xx, IP/DNS, 3CX and Forbidden Caller

[SweetAction]

In a situation where you have a Grandstream HT802, provisioned with 3CX, on a local lan, the device will use the DNS name of the PBX to register and work fine.

Now, the grandstream isn't supported behind a SBC. I'm aware of this already.
HOWEVER....
Take that same ATA, change the Primary SIP Server to the IP of the SBC, and it will register and work as expected.

Where this gets interesting is when you use a DNS name instead of the IP. The Grandstream device will resolve the name (to the internal IP of the SBC) and register no issue. However, calls will fail with an error "Incoming call rejected, caller is unknown". This appears to be because sometimes the device comes into 3CX as ext@hostname and sometimes it comes in as ext@ip

Take these logs pieces:

09/26/2019 9:51:04 PM - Updating device Dev(181158615):[sip:[email protected]:5060 / 8813] by message: DevUpd Recv Req REGISTER from 127.0.0.1:5080 tid=897229342 [email protected]:
-------------
09/26/2019 9:51:56 PM - Call from <sip:[email protected]>;tag=1739580934 to <sip:[email protected]>;tag=1416fe27
-------------
09/26/2019 9:51:56 PM - IncomingCall: C:11 from <sip:[email protected]:5060> to <sip:[email protected]:5060>
-------------
09/26/2019 9:51:56 PM - [CM503013]: Call(C:11): Incoming call rejected, caller is unknown; msg=Invite-IN Recv Req INVITE from 127.0.0.1:5080 tid=1456272333 [email protected]:
-------------
09/26/2019 9:51:56 PM - L:11.1[Unknown:] Sending: OnSendResp Send 603/INVITE from 0.0.0.0:0 tid=1456272333 [email protected]:
Warning: 499 <PBXDNSNAME> "Caller is forbidden"
-------------
09/26/2019 9:51:56 PM - Terminated from <sip:[email protected]>;tag=1739580934 to <sip:[email protected]>;tag=1416fe27; reason: Rejected

All this to ask... does anyone know how I could configure the grandstream to always use the name or always use the IP?

(SBC Hostname replaced with redacted.com)

These seem similar: https://www.3cx.com/community/threads/incoming-call-rejected-caller-is-unknown-external.15905/
and https://www.3cx.com/community/threads/incoming-call-rejected-caller-is-uknown.59024/

 

[eddv123]

I think this could be a question of your internal DNS resolver, do you have an entry on your DNS server (since you were using local) for 3CX FQDN >> Local IP address or external ?

https://www.3cx.com/docs/creating-fqdn-split-dns/

 

[BrenttG]

Maybe try setting up the HT802 without any dns, everything using ip....

 

[SweetAction]

I think this could be a question of your internal DNS resolver, do you have an entry on your DNS server (since you were using local) for 3CX FQDN >> Local IP address or external ?

https://www.3cx.com/docs/creating-fqdn-split-dns/

The DNS resolver is resolving redacted.com to the internal IP of the SBC.

Maybe try setting up the HT802 without any dns, everything using ip....

Using IP it works. Using DNS it doesn't.

And that's the question. Why is it that devices behind the ATA someone use their IP and sometimes use the hostname. Or better yet, how can I force it to use only hostname or tell 3cx to allow this behavior.

 

[eddv123]

I set up 3 Patton FXS channelbanks (4324 x2 4332 x1) via SBC yesterday and did not experience any issues.

I did not resolve the FQDN to the local IP (as we were not using VPN) so let it resolve to the PBX's external IP address (use external servers).

I assume (like I did) you generated a config file from 3CX for the device and changed all registrar addresses (whether they be IP or FQDN) to that of the SBC itself ?

Where I think DNS is part of the problem, if it was complete resolution then your SBC/tunnel to the remote server would disconnect (you would see error's in the SBC logs) so there is more to it than just DNS.