Need help isolating why phones are going registered/unregistered

[newuser1]

What is the best way to isolate root cause of a phone going from reg/unreg state? I've opened a case with firewall vendor and they want to know why they are seeing SIP/2.0 407 Proxy Authentication Required messageSIP/2.0 407 Proxy Authentication Required message in the logs. What would cause that message? I have verified the phone SIP user and password is entered correctly. Any other ideas?

Thanks.

 

[JohnS_3CX]

Hi @newuser1

This is a very abstract description, can you give us a very detailed description of what you observed the problem to be, what the network setup is, you pbx version, phone models affected etc to see if we can assist you?

SIP 407 is the typical method phones use to authenticate on a PBX. It's simply the PBX telling the phone "hey before I serve you, please authenticate your password" and this will always happen under normal circumstances. To be honest I don't understand why your vendor is asking this question..

 

[newuser1]

Sophos ran a packet capture and saw the 407s which I wasn't familiar with and pointed that as the issue. The device is a Sophos XG 135. Is there anything you can suggest besides there suggestion of unloading their SIP module on the firewall as a work around?

The remote site is set up to similar other working sites we have and we receive no packet loss when running a continuous ping.

 

[JohnS_3CX]

So to understand correctly, you have a 3CX system behind a Sophos XG135 firewall, and you have remote extensions over STUN that keep unregistering?

 

[newuser1]

Yes. The phones in question are Yealink T48S. The web app for Windows doesn't appear to have any issues, only hardware related to the phones going reg/unreg.

 

[JohnS_3CX]

Does the 3CX firewall test pass?

And how are the phones currently provisioned?

 

[newuser1]

The firewall test shows red; however, we have other remote sites that work with no issues. The provisioning method is direct sip. The phone subnet has dhcp option with 3cx provisioning link that appears to be working as if you default a phone, it then finds the configuration.

 

[JohnS_3CX]

If the PBX firewall is red then you may face intermittent issues. I would check the firewall at the phones site, and also the port assignments in the PBX for each device to make sure there is no overlap.

On the phone site, do you have the option of adding an SBC? It might be an easier solution in your specific case and can overcome local firewall issues, provide PnP provisioning without DHCP Option 66 and provides a tunnel for the traffic and registrations. You will need two ports only opened at the phones site.