IP blocked for Reason: Block WAN requests is ON but set to allowed?

[MPServeline]

Hi all,

I'm getting lots of warnings stating:

SIP request (REGISTER) from xx.xx.xx.xx was rejected. Reason: Block WAN requests is ON.. Message: REGISTER.sip.xxx.3cx.uk:5060 SIP/2.0

The IP referenced is under IP Blacklist with action allow?

Please can someone advise as it seems to be affecting phones at that site trying to register?

Many thanks

 

[MPServeline]

Thanks all, yes we have got a bit further on this now as there was a server at the site with the IP address in the error message with an SBC on it which is decommissioned.

There are a number of Polycom phones so definitely helpful the suggestion to try and find it as need a Mac or local IP to try and get onto it and access the web config if we can.

We have installed the SBC on another server there to see if it comes in on that possibly.

 

[MPServeline]

Unfortunately the error doesn't seem to give the local IP after Via:

SIP request (REGISTER) from <external IP> was rejected. Reason: Block WAN requests is ON. . Message:. REGISTER sip:X.3cx.uk:5060 SIP/2.0. Via: SIP/2.0/UDP <External IP>:61193;rport=61193;branch=z9hG4bKbc8a6f94ED2BA35A. Max-Forwards: 70. Contact: <sip:111@<External IP>:61193>;methods="INVITE,ACK,BYE,CANCEL,OPTIONS,INFO,MESSAGE,SUBSCRIBE,NOTIFY,PRACK,UPDATE,REFER". To: <sip:[email protected]>. From: "<Whitelisted IP Name>" <sip:[email protected]>;tag=815BE179-7F70E6B. Call-ID: 2a5527ed2c687d7b8da7d1959116ae09. CSeq: 2 REGISTER. Expires: 120. Accept: application/sdp, application/csta+xml. Accept-Language: en-us, en;q=0.9. Proxy-Authorization: Digest username="hT7RRYsaD5",realm="3CXPhoneSystem",nonce="414d53590015902f60:ee0424e3fd91a1417e71a989d8ee85f6",uri="sip:X.3cx.uk:5060",response="fcc98d769c73fe89daa8f795eed4bd06",algorithm=MD5. User-Agent: PolycomVVX-VVX_411-UA/6.4.3.5018. Content-Length: 0

 

[JohnS_3CX]

There are a number of Polycom phones so definitely helpful the suggestion to try and find it as need a Mac or local IP to try and get onto it and access the web config if we can.

If you can run packet captures on their local firewall you can possibly find which one is sending SIP REGISTER from user 111.

Otherwise I'm afraid you will need to unplug them one by one until the attempts stop.