IP Address Blocked

[carlwright]

Hi. We have had an ongoing problem with our 3cx server blocking our public IP address with the message: PBX: blocked for too many failed authentications; User-Agent: Avaya IP Phone 1120E

We do not have any Avaya devices on our network.

We have blocked access to port 5060 to the entire internet.

When the public IP address is blocked, this prevents our 3cx iphone apps connecting properly.

Are there any other suggestions as to how to resolve this?

Thanks
Carl

 

[Lee Cramman]

Assuming you mean your own IP address is blacklisted then whitelist the address?

However, I'm not sure that is what you mean... I didn't think what you are describing (blacklisting your own IP address) is possible.

Also, why don't you block 5060 except to your SIP provider?

Are you cloud or on-premise install?

 

[Alphabetic]

You wouldnt stick the IP of your PBX in to the blacklist so one has to assume your PBX is hosted elsewhere.

If this blacklist IP is actually your office WAN and you have notifications coming in specifying this then you need to look at your network as this should be a concern.

How secure is this network that you say is your WAN IP?

 

[Lee Cramman]

You wouldnt stick the IP of your PBX in to the blacklist so one has to assume your PBX is hosted elsewhere.

If this blacklist IP is actually your office WAN and you have notifications coming in specifying this then you need to look at your network as this should be a concern.

How secure is this network that you say is your WAN IP?

Suspect the OP is mistaken about the IP address. If not they have bigger problems .

 

[SteveITS]

Hi. We have had an ongoing problem with our 3cx server blocking our public IP address with the message: PBX: blocked for too many failed authentications; User-Agent: Avaya IP Phone 1120E

I'm guessing you have 3CX hosted outside your office? Being blocked can also happen if users try to log in to https://servername with their extension instead of https://servername/webclient. In Security/IP Blacklist add your office IP as an Allow. That should at least stop blocking your office IP and you can chase down what's trying to connect.

We also Allow SIP trunk IPs so they don't get blocked if someone makes a typo in the credentials or something.

 

[JohnS_3CX]

The user agent Avaya is a bit of a concern if

a) The IP making the attempt is your office
b) You have no such phone

It would imply that the attack is possibly coming from within your office, or an external attacker found a way in the office network, and is launching an attack locally.

This is pure speculation of course, you should monitor your office firewall and trace the traffic back to its source. The traces can be filtered for anything that contains the the same string of the user agent.