Not receiving Fax - No RTP packets were received

[venkman]

I am currently having an issue receiving FAX to email on our 3CX.

We are running v14 SP3 with a Pro license, and are using a 3CX recommened SIP provider.

Steps taken:

* We have confirmed with the provider that we have T.38 protocol enabled on our SIP trunk
* Confirmed that email notifications are being received from the 3CX server, so the mail server is configured correctly.
* Our firewall is configured to forward ports 6000-20000 (UDP) to the 3CX server as recommended by our provider, therefore RTP should be included in this range
* Temporarily disabled Windows Firewall on the 3CX server to rule this out
* Rebooted 3CX server and re-tested
* Ensured Fax Service is running

I am sending a test fax from a web to fax service, which is failing. When the fax is sent, we get the following logs in the 3CX Activity Log (I've removed info such as FQDN and SIP address for security):

13-Jul-2016 09:57:01.115 [MS105000] C:18.2: No RTP packets were received:remoteAddr=127.0.0.1:10002,extAddr=0.0.0.0:0,localAddr=127.0.0.1:7066
13-Jul-2016 09:57:00.634 Leg L:18.2[Fax] is terminated: Cause: BYE from PBX
13-Jul-2016 09:57:00.634 [CM503008]: Call(C:18): Call is terminated
13-Jul-2016 09:57:00.632 Leg L:18.1[Line:10000<<unavailable] is terminated: Cause: BYE from 154.51.139.13:5060
13-Jul-2016 09:56:34.682 Currently active calls - 1: [18]
13-Jul-2016 09:56:18.121 [CM503007]: Call(C:18): Fax:888 has joined, contact <sip:[email protected]:5006>
13-Jul-2016 09:56:18.121 [CM503007]: Call(C:18): Line:10000<<unavailable has joined, contact <sip:removed:5060>
13-Jul-2016 09:56:18.119 L:18.2[Fax] has joined to L:18.1[Line:10000<<unavailable]
13-Jul-2016 09:56:18.051 [CM503025]: Call(C:18): Calling T:Fax:888@[Dev:sip:[email protected]:5006;user=phone] for L:18.1[Line:10000<<unavailable]
13-Jul-2016 09:56:18.008 [CM503027]: Call(C:18): From: Line:10000<<unavailable ("Fax to Email:" <sip:unavailable@PBX_FQDN:5060>) to T:Fax:888@[Dev:sip:[email protected]:5006;user=phone]
13-Jul-2016 09:56:18.008 [CM503004]: Call(C:18): Route 1: from L:18.1[Line:10000<<unavailable] to T:Fax:888@[Dev:sip:[email protected]:5006;user=phone]
13-Jul-2016 09:56:18.007 [CM505003]: Provider:[ProviderName] Device info: Device Not Identified: User Agent not matched; Capabilities:[reinvite, replaces, able-no-sdp, recvonly] UserAgent: [] PBX contact: [sip:removed@external_IP:5060]
13-Jul-2016 09:56:18.006 [CM503001]: Call(C:18): Incoming call from Line:10000<<unavailable to <sip:[email protected]:5060>
13-Jul-2016 09:56:18.006 Line limit check: Current # of calls for line Lc:10000(@Provider[<sip:removed:5060>]) is 1; limit is 8
13-Jul-2016 09:56:18.000 [CM503012]: Inbound any hours rule (Fax to Email) for 10000 forwards to Fax:888

I've also run a Wireshark packet capture when sending the fax, and can see that the T.38 protocol is being used (please see Flow Sequence PDF attached).

Our SIP provider has suggested that this looks to be a Firewall issue, however we have ruled out Windows Firewall and RTP looks to be forwarded on our main firewall. Can anyone suggest and other things I can check?

Thanks in advance!

 

[lneblett]

Has the fax function ever been successful before?

I have attached a similar flow of a successful fax for comparison. In my case, as you can see, the contact starts with the provider invite ultimately resulting in the fax coming from a different media server. You will note, that in my case, it started off with some g711 RTP packets before it transitioned. I am uncertain why on your flow the ports are alternating between 9016 and 9018.

I can only suggest the need to analyze the wireshark capture and see the details.The OK/SDP will be of interest.

Does your provider have a set of IPs that they use and are these in the router?

 

[venkman]

Hi lneblett,

No, the fax has never been successful. We have only been using 3CX since 13th June and this is the first time fax has been set up.

Thanks for the flow for comparrison, I will try to have a look at the capture again.

Yes, the provider does have a set of IPs. Our firewall was filtering on source address using these IPs (i.e. would only forward ports 6000-20000 when the source address is the provider). However, I changed the source to any to test and it still didn't work.

 

[roadwings]

Few things about our fax setup that stumped me earlier...

We had to add a 1 before our telephone number when setting up the trunk.

We had to open port 5060 to the provider on the firewall.

I could not get a fax to go to 888, I had to make another account and direct faxes there.

Good luck.