MCU Connection Failed 0x0020

[Ecki]

Hello,

we are experiencing the error "MCU Connection Failed 0x0020" during the creation of web meetings.

We have checked the firewall logs and the required servers for the 3cx video conference cloud platform (https://www.3cx.com/blog/voip-howto/video-conference-server-optimization/)
and are seeing at least one 3cx ip beeing blocked by our firewall because it has been flagged malicious.

For example https://www.abuseipdb.com/check/164.90.202.110

I know this could be solved by disabling the filter on the firewall and therefore reducing security..

Is there a way to change 3cx default behaviour and maybe have it retry if the ip is not reachable?

Is this solvable if the local MCU is used? Or will v18-vc-qos.3cx.net still be in use?

The video conference region is currently set to europe.

Thanks in advance!

# nslookup v18-vc-qos.3cx.net
;; Truncated, retrying in TCP mode.
Server:         XXX.XXX.XXX.XXX
Address:        XXX.XXX.XXX.XXX#53

Non-authoritative answer:
Name:   v18-vc-qos.3cx.net
Address: 170.64.145.108
Name:   v18-vc-qos.3cx.net
Address: 34.176.174.48
Name:   v18-vc-qos.3cx.net
Address: 35.221.175.237
Name:   v18-vc-qos.3cx.net
Address: 142.93.238.81
Name:   v18-vc-qos.3cx.net
Address: 34.35.69.212
Name:   v18-vc-qos.3cx.net
Address: 158.160.170.22
Name:   v18-vc-qos.3cx.net
Address: 157.245.108.209
Name:   v18-vc-qos.3cx.net
Address: 167.172.102.66
Name:   v18-vc-qos.3cx.net
Address: 158.160.173.12
Name:   v18-vc-qos.3cx.net
Address: 164.90.202.110
Name:   v18-vc-qos.3cx.net
Address: 188.166.157.144
Name:   v18-vc-qos.3cx.net
Address: 20.233.253.21
Name:   v18-vc-qos.3cx.net
Address: 170.64.163.104
Name:   v18-vc-qos.3cx.net
Address: 142.93.52.187
Name:   v18-vc-qos.3cx.net
Address: 142.93.62.154
Name:   v18-vc-qos.3cx.net
Address: 170.64.225.88
Name:   v18-vc-qos.3cx.net
Address: 68.183.38.148
Name:   v18-vc-qos.3cx.net
Address: 34.35.67.34
Name:   v18-vc-qos.3cx.net
Address: 167.71.231.53
Name:   v18-vc-qos.3cx.net
Address: 34.35.48.161
Name:   v18-vc-qos.3cx.net
Address: 146.190.48.212
Name:   v18-vc-qos.3cx.net
Address: 164.92.177.252
Name:   v18-vc-qos.3cx.net
Address: 206.189.24.168
Name:   v18-vc-qos.3cx.net
Address: 158.160.173.82
Name:   v18-vc-qos.3cx.net
Address: 188.166.156.218
Name:   v18-vc-qos.3cx.net
Address: 34.176.3.76
Name:   v18-vc-qos.3cx.net
Address: 20.233.252.141
Name:   v18-vc-qos.3cx.net
Address: 46.101.139.138
Name:   v18-vc-qos.3cx.net
Address: 35.247.196.146
Name:   v18-vc-qos.3cx.net
Address: 20.233.253.25

 

[MarcelloV]

Hi @Ecki , the IP address you are referring to was not running our services at the time of the report. Dynamic MCUs are on demand servers which are started only when needed to handle the load. This specific server was started today at 08:03:19 UTC, so it's totally unrelated to the malicious activities reported by "abuseipdb".
I must say that these kind of reports are pretty useless (if not dangerous) because these IPs can be reassigned every hour to a different server running a different service.

There is also a retry mechanism... after 120 seconds, if the meeting doesn't start on the assigned MCU, another MCU is selected from the pool.

Of course, if you use the OnBoard MCU feature you're in complete control and you get the best security.