outbound calls dropping after 1min 8 seconds

[NDHIP]

HI as per the title , i've onboarded a new sip this week due to issues with our isdn line, all is fine inbound, outbound all calls drop after 1min 8 seconds

we have a sophos xg310 fw, which i have updated the udp stream on to 150seconds.

any guidance or help would be appreciated

the wireshark traces looks like this



looking at the bye command i see the following, im reading that from some reason 3cx is sending an icmp to the handset and then to the sip provider and not getting a response so is dropping the call.

 

[NDHIP]

anyone?

 

[TheodorosG_3CX]

The fact that some RTP are not reaching the endpoint RTP port has to be checked internally.
However the 501 that is coming from the firewall needs to be checked.
As a first step ensure that the firewall checker is passed successfully.

 

[NDHIP]

hi , firewall checks passing fine

 

[TheodorosG_3CX]

You need to check on your firewall why is responding with 501. For the most common sip responses you may also check this guideline here.

 

[NDHIP]

i'm only seeing the 501 on one handset which i was using for testing ( a snom) , the issue is happening on all handsets and through the web browser when dialling out.

This is from a yealink t28p to a mobile

 

[OlegR_3CX]

So if you dial internally between 2 users, do you face the same issue?
Also, your phones, and 3CX System are in different subnets?

 

[NDHIP]

Hi internally and inbound calls where working fine ( they are both back on the old isdn now) , just outbound

3cx and handsets are all on 172.16.7 subnet, just webclient would be on a different subnet

 

[OlegR_3CX]

So when call drop, is it dropped from the provider end or 3CX system, who ends the call based on the captures?
Additionally, you can see from where request comes in (MAC address etc.), as if firewall in between and request from its interface, then you might need to look in that direction

 

[NDHIP]

the BYE message is linked to this in the dump file

 

[OlegR_3CX]

So whose IP is this, is it a provider IP?

 

[NDHIP]

172.16.7.83 is the yealink phone, 172.16.7.240 is 3cx , 195.x.x.x is our sip provider

 

[OlegR_3CX]

From the screenshot you show, PBX sends bye to the phone, but there is no indication of the provider, and maybe you are not selecting the provider part of the call. Do that and check if the provider is sending BYE, and if that's the case, maybe you should check with them further.