Outbound call error(Call Forbidden by Administrator) - 403 Forbidden, 403 Spoofed From-URI Detected

[Yellow_Flash]

Hi,

• 3CX Version 15.5 SP6, Perpetual
• Server OS, windows 10
• On premise Server
• CIsco Spa504G, Firmware 7.6.1
• Provisioning Method: Local
• Trunk Provider (VoipTalk and VoipUnlimited)
• Has the Firewall Checker passed: YES
• Are custom Phone Templates being used: NO

We have an on premise server, v15.5 SP6. It has been working properly but from yesterday we are not able to make outbound calls to one number, and the response being given is "call Forbidden by the Adminnistrator". When I checked the logs I could find that one of the voip providers is giving the error
"403 : call Forbidden", while the second voip provider gives the error "403 Spoofed From-URI Detected"

Can someone please let me know what the issue is? Where I should look?
Since both the providers are giving same error, I believe the issue is in the PBX side, but i will be checking with the voip providers too. It would be great if someone can give some insight into this issue.
I've also attached the log from 3cx below.
Thank you.

02/19/2020 11:13:52 AM - Leg L:11291.1[Extn:xxx] is terminated: Cause: BYE from local
02/19/2020 11:13:52 AM - [CM503008]: Call(C:11291): Call is terminated
02/19/2020 11:13:52 AM - [CM503023]: Call(C:11291): Call recording is stopped,
audio file: E:\Data\Recordings\xxx/name.wav
02/19/2020 11:13:52 AM - Leg L:11291.4[EndCall:EndCall] is terminated: Cause: BYE from 127.0.0.1:5483
02/19/2020 11:13:49 AM - [CM503007]: Call(C:11291): EndCall:EndCall has joined,
contact <sip:[email protected]:5483>
02/19/2020 11:13:49 AM - [CM503007]: Call(C:11291): Extn:xxx has joined,
contact <sip:[email protected]:20151>
02/19/2020 11:13:49 AM - [CM503022]: Call(C:11291): Call recording is started,
audio file: E:\Data\Recordings\xxx/name.wav
02/19/2020 11:13:49 AM - L:11291.4[EndCall:EndCall] has joined to L:11291.1[Extn:xxx]
02/19/2020 11:13:49 AM - [CM503002]: Call(C:11291): Alerting EndCall:EndCall by contact
<sip:[email protected]:5483>
02/19/2020 11:13:48 AM - [CM503025]: Call(C:11291):
Calling T:EndCall:EndCall@[Dev:sip:[email protected]:5483;
rinstance=faf307c3016ee35a] for L:11291.1[Extn:xxx]
02/19/2020 11:13:48 AM - L:11291.1[Extn:xxx] failed to reach Line:10003> Dialed Number,
reason Forbidden
02/19/2020 11:13:48 AM - Leg L:11291.3[Line:10003>>Dialed Number] is terminated:
Cause: 403 Spoofed From-URI Detected/INVITE from 91.151.2.xxx:5060
02/19/2020 11:13:48 AM - Call to T:Line:10003>>Dialed Number@[Dev:sip:Caller [email protected]:5060]
from L:11291.1[Extn:xxx] failed, cause:
Cause: 403 Spoofed From-URI Detected/INVITE from 91.151.2.xxx:5060
02/19/2020 11:13:48 AM - [CM503003]: Call(C:11291): Call to <sip: Dialed [email protected]:5060>
has failed; Cause: 403 Spoofed From-URI Detected/INVITE from 91.151.2.xxx:5060
02/19/2020 11:13:48 AM - Leg L:11291.2[Line:10001>>Dialed Number] is terminated:
Cause: 403 Forbidden/INVITE from 77.240.48.xxx:5060
02/19/2020 11:13:48 AM - [CM503025]: Call(C:11291):
Calling T:Line:10003>>Dialed Number@[Dev:sip:Caller [email protected]:5060] for L:11291.1[Extn:xxx]
02/19/2020 11:13:48 AM - Call to T:Line:10001>>Dialed Number@[Dev:sip:[email protected]:5060]
from L:11291.1[Extn:xxx] failed, cause: Cause: 403 Forbidden/INVITE from 77.240.48.xxx:5060
02/19/2020 11:13:48 AM - [CM503003]: Call(C:11291): Call to <sip: Dialed [email protected]:5060>
has failed; Cause: 403 Forbidden/INVITE from 77.240.48.xxx:5060
02/19/2020 11:13:47 AM - [CM505003]: Provider:[VoipTalk] Device info: Device Not Identified:
User Agent not matched; Capabilities:[reinvite, replaces, able-no-sdp, recvonly]
UserAgent: [VoIPGW] PBX contact: [sip:serverIP:5060]
02/19/2020 11:13:47 AM - [CM503002]: Call(C:11291): Alerting Line:10001>>DailedNumber by contact <sip:[email protected]:5060>
02/19/2020 11:13:43 AM - [CM503025]: Call(C:11291): Calling T:Line:10001>>DialedNumber@[Dev:sip:[email protected]:5060] for L:11291.1[Extn:xxx]
02/19/2020 11:13:43 AM - [CM503027]: Call(C:11291): From: Extn:xxx ("Display Name" <sip:[email protected]:5060>) to
T:Line:10003>>DialedNumber@[Dev:sip:[email protected]:5060]
02/19/2020 11:13:43 AM - [CM503004]: Call(C:11291): Route 2: from L:11291.1[Extn:xxx] to T:Line:10003>>DialedNumber@[Dev:sip:[email protected]:5060]
02/19/2020 11:13:43 AM - Line limit check: Current # of calls for line
Lc:10003([USER=10934]@voip[/USER] Unlimited[<sip:[email protected]:5060>]) is 0; limit is 100
02/19/2020 11:13:43 AM - [CM503027]: Call(C:11291):
From: Extn:xxx ("Display Name" <sip:xxx@FQDN:5060>) to T:Line:10001>>DialedNumber@[Dev:sip:[email protected]:5060]
02/19/2020 11:13:43 AM - [CM503004]: Call(C:11291): Route 1: from L:11291.1[Extn:xxx] to T:Line:10001>>DialedNumber@[Dev:sip:[email protected]:5060]
02/19/2020 11:13:43 AM - Line limit check: Current # of calls for line
Lc:10001([USER=27776]@voiptalk[/USER][<sip:[email protected]:5060>]) is 0; limit is 20
02/19/2020 11:13:43 AM - Call(C:11291): Call from Extn:xxx to "DialedNumber" matches
outbound rule 'VoipTalk-0'
02/19/2020 11:13:43 AM - [Flow] Call(C:11291): has built target endpoint:
Out#:>>Rule{VoipTalk-0}>>DialedNUmber for call from L:11291.1[Extn:xxx]
02/19/2020 11:13:43 AM - [Flow] Target endpoint for DialedNumber is Out
#:>>Rule{VoipTalk-0}>>DialedNumber
02/19/2020 11:13:43 AM - [CM503010]: Call(C:11291): Making route(s) from Extn:xxx to <sip: DialedNumber@FQDN:5060>
02/19/2020 11:13:43 AM - [CM505001]: Endpoint Extn:xxx: Device info: Device Not Identified:
User Agent not matched; Capabilities:[reinvite, replaces, able-no-sdp, recvonly]
UserAgent: [Cisco/SPA504G-7.6.1] PBX contact: [sip:xxx@PbxIP:5060]
02/19/2020 11:13:43 AM - [CM500002]: Call(C:11291): Info on incoming INVITE from Extn:xxx:
Invite-IN Recv Req INVITE from 202.140.xx.xxx:20151 tid=-4c281fa
[email protected]: INVITE sip: Dialed Number@FQDN SIP/2.0
Via: SIP/2.0/UDP 202.140.47.2:20151;branch=z9hG4bK-4c281fa Max-Forwards: 70
Contact: "Display Name" <sip:[email protected]:20151>
To: <sip: DialedNumber@FQDN>
From: "Display Name"<sip:xxx@FQDN>;tag=5c4386f91c4c723do0
Call-ID: [email protected]
CSeq: 102 INVITE Expires: 240
Allow: ACK, BYE, CANCEL, INFO, INVITE, NOTIFY, OPTIONS, REFER, UPDATE
Content-Type: application/sdp Proxy-Authorization: Digest username="xxx",realm="3CXPhoneSystem",
nonce="414d535c145d5c0f10:cc6d87dfbab76344e7e9ae4f559ad3e4",uri="sip: DialedNumber@FQDN",algorithm=MD5,response="4262c181d24dace031c54cb0781e5777" Supported: replaces User-Agent: Cisco/SPA504G-7.6.1 Content-Length: 429 v=0 o=- 213795427 213795427 IN IP4 202.140.47.2 s=- i=(o=IN IP4 192.168.2.222) c=IN IP4 202.140.47.2 t=0 0 m=audio 34424 RTP/AVP 0 2 8 9 18 96 97 98 101 a=rtpmap:0 PCMU/8000 a=rtpmap:2 G726-32/8000 a=rtpmap:8 PCMA/8000 a=rtpmap:9 G722/8000 a=rtpmap:18 G729a/8000 a=rtpmap:96 G726-40/8000 a=rtpmap:97 G726-24/8000 a=rtpmap:98 G726-16/8000 a=rtpmap:101 telephone-event/8000 a=fmtp:101 0-15 a=ptime:30 a=sendrecv
02/19/2020 11:13:43 AM - [CM503001]: Call(C:11291): Incoming call from Extn:xxx to <sip: DialedNumber@FQDN:5060>

 

[3C Technology]

Hi There it could be a number of things causing the issue. One way to rule your pbx out of the equation is to try the number from a mobile phone and see if it connects or fails as well.If it fails there is clearly an issue on the far side. If it is successful you will need to work with your providers to identify the issue and correct it.

11:13:48 AM - Call to T:Line:10001>>Dialed Number@[Dev:sip:[email protected]:5060]
from L:11291.1[Extn:xxx] failed, cause: Cause: 403 Forbidden/INVITE from 77.240.48.xxx:5060

 

[Yellow_Flash]

Thanks. Yes, Will have a check on that too.
Since it is a UK number and we provide support from remote location, it takes us time to check the number using a mobile number. Can only be done once the UK office comes online.