Outgoing calls from remote phones - Forbidden

Discussion in '3CX Phone System - General' started by netcio, Jul 20, 2013.

Thread Status:
Not open for further replies.
  1. netcio

    Joined:
    Mar 27, 2009
    Messages:
    11
    Likes Received:
    0
    3CX V11
    I'm having trouble calling out from remote phones. The # dials, then immediately produces Forbidden on the console. This does this with physical phones and the 3CXPhone for Windows which I installed to do some testing. Incoming calls connect, but the audio does not work.
    I think if I can get the outgoing calls to connect, the audio piece will work itself out.

    Set up verbose logging as per one blog or post I read and here is the log from one of the calls, call made to *777 per blog post:
    <Public IP removed>

    20-Jul-2013 10:27:58.340 [CM500002]: Unidentified incoming call. Review INVITE and adjust source identification:
    Invite-UNK Recv Req INVITE from <Public IP of PBX>:59898 tid=d561ec638c740a26 Call-ID=NjA3NTU5ZGYwZTJhZjY2YTg2NjE0MTNhNmIxNjFjNWY.:
    INVITE sip:3610307@<Public IP of PBX>:5060 SIP/2.0
    Via: SIP/2.0/UDP 192.168.168.34:59898;branch=z9hG4bK-d8754z-d561ec638c740a26-1---d8754z-;rport=59898;received=<Public IP of PBX>
    Max-Forwards: 70
    Contact: <sip:101@<Public IP of PBX>:59898;transport=UDP>
    To: <sip:3610307@<Public IP of PBX>:5060>
    From: "Jeff"<sip:101@<Public IP of PBX>:5060>;tag=c3145a5d
    Call-ID: NjA3NTU5ZGYwZTJhZjY2YTg2NjE0MTNhNmIxNjFjNWY.
    CSeq: 1 INVITE
    Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REGISTER, SUBSCRIBE, NOTIFY, REFER, INFO, MESSAGE
    Content-Type: application/sdp
    Supported: replaces
    User-Agent: 3CXPhone 6.0.26523.0
    Content-Length: 284
    X-Dc: PHNpcDoxMDFAMTc0Ljc3LjE2NC4xMjQ6NTk4OTg7dHJhbnNwb3J0PVVEUD4=
    X-Dv: U0lQLzIuMC9VRFAgMTkyLjE2OC4xNjguMzQ6NTk4OTg7YnJhbmNoPXo5aEc0YkstZDg3NTR6LWQ1NjFlYzYzOGM3NDBhMjYtMS0tLWQ4NzU0ei07cnBvcnQ=
    X-Dsa: MTc0Ljc3LjE2NC4xMjQ=
    X-Damp: NDAwMTI=

    v=0
    o=3cxVCE 358782735 238678230 IN IP4 <Public IP of PBX>
    s=3cxVCE Audio Call
    c=IN IP4 <Public IP of PBX>
    t=0 0
    m=audio 40012 RTP/AVP 0 8 3 101
    a=rtpmap:0 PCMU/8000
    a=rtpmap:8 PCMA/8000
    a=rtpmap:3 GSM/8000
    a=rtpmap:101 telephone-event/8000
    a=fmtp:101 0-15
    a=ptime:20
    a=sendrecv
    20-Jul-2013 10:17:43.877 Leg L:3.1[Unknown:] is terminated: Cause: BYE from PBX
    20-Jul-2013 10:17:43.832 [CM502001]: Source info: From: "Jeff"<sip:101@<Public IP of PBX>:5060>;tag=7943c474; To: <sip:*777@<Public IP of PBX>:5060>
    20-Jul-2013 10:17:43.832 [CM503013]: Call(C:3): Incoming call rejected, caller is unknown; msg=Ivite-IN Recv Req INVITE from <Public IP of PBX>:59898 tid=4968fa49d10eb624 Call-ID=YmIyZTg2ZmIzMjJhN2FmNGI1MzZiZjdkOWRjMmE2ZWY.:
    INVITE sip:*777@<Public IP of PBX>:5060 SIP/2.0
    Via: SIP/2.0/UDP 192.168.168.34:59898;branch=z9hG4bK-d8754z-4968fa49d10eb624-1---d8754z-;rport=59898;received=<Public IP of PBX>
    Max-Forwards: 70
    Contact: <sip:101@<Public IP of PBX>:59898;transport=UDP;rinstance=91a7ebd7db281aee>
    To: <sip:*777@<Public IP of PBX>:5060>
    From: "Jeff"<sip:101@<Public IP of PBX>:5060>;tag=7943c474
    Call-ID: YmIyZTg2ZmIzMjJhN2FmNGI1MzZiZjdkOWRjMmE2ZWY.
    CSeq: 2 INVITE
    Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REGISTER, SUBSCRIBE, NOTIFY, REFER, INFO, MESSAGE
    Content-Type: application/sdp
    Proxy-Authorization: Digest username="101",realm="3CXPhoneSystem",nonce="414d535c07fb573726:8936cd876147f1931cc0d9d94cec7606",uri="sip:*777@<Public IP of PBX>:5060",response="0c1575b660949e0d84d0177bc4001e8a",algorithm=MD5
    Supported: replaces
    User-Agent: 3CXPhone 6.0.26523.0
    Content-Length: 284
    X-Dc: PHNpcDoxMDFAMTc0Ljc3LjE2NC4xMjQ6NTk4OTg7dHJhbnNwb3J0PVVEUDtyaW5zdGFuY2U9OTFhN2ViZDdkYjI4MWFlZT4=
    X-Dv: U0lQLzIuMC9VRFAgMTkyLjE2OC4xNjguMzQ6NTk4OTg7YnJhbmNoPXo5aEc0YkstZDg3NTR6LTQ5NjhmYTQ5ZDEwZWI2MjQtMS0tLWQ4NzU0ei07cnBvcnQ=
    X-Dsa: MTc0Ljc3LjE2NC4xMjQ=
    X-Damp: NDAwMTA=

    I'm looking for some deeper instructions on anything related to authentication, as I <think> that is what's causing the connection from external outbound.
    Thanks for any help/insight.
    Jeff
     
  2. leejor

    leejor Well-Known Member

    Joined:
    Jan 22, 2008
    Messages:
    10,355
    Likes Received:
    223
    A couple of points when using external extensions.

    You have to specifically enable that function in the (each) extension options (allow this extension to register from outside the LAN).

    You've hidden the actual public IP of the server (a good thing), but I can't tell if you are actually sending to an IP or a URL. If the remote set is sending to a URL, that "name" must be in datafilled 3CX as the Domain Name or calls will be rejected.



    You don't mention if the remote set is registering correctly, or you are simply attempting a call without registration.

    You also don't say which receives gets no audio. That may give a clue as to what is happening too.
     
  3. netcio

    Joined:
    Mar 27, 2009
    Messages:
    11
    Likes Received:
    0
    Hi Leejor
    Thanks for the reply.
    I have enabled that function for each extension in the 3CX console.
    I'm using the actual IP address, I do have an A record setup, but have found that the IP is easier to use.
    Both remotes have registered in the 3CX and they both can initiate a call, even appears that on the 3CX softphone, it will ring once before it receives the Forbidden. The Forbidden happens immediately on the physical phone.
    The both get no audio, although when I connected to the physical phone via my cell phone the connection stayed alive. No audio either way.
    Appreciate the help!
    Jeff
     
  4. leejor

    leejor Well-Known Member

    Joined:
    Jan 22, 2008
    Messages:
    10,355
    Likes Received:
    223
    You have replaced everything with public IP of PBX, but some of the IP's must be from the originating end, either the Public or private.

    Have you successfully run the firewall checker on 3CX?

    Confirmed that the remote IP is not in the IP blacklist?

    Tried using the set at another location? (behind another router)

    I'm assuming that the "forbidden" is occurring for every number dialled.
     
  5. jpillow

    jpillow Well-Known Member

    Joined:
    Jun 20, 2011
    Messages:
    1,342
    Likes Received:
    0
    under the extensions tab--->Phone provisioning--->and check the box marked pbx delivers audio, that may help with the one way audio issue, give it a try I hope it works out for you.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  6. netcio

    Joined:
    Mar 27, 2009
    Messages:
    11
    Likes Received:
    0
    I left the private IP's visible in the log, I only removed the public IP, where applicable.
    Have successfully run the firewall checker.
    Have not checked the IP blacklist, will do that as soon as I get back on system.
    Also have not tried at another location.
    Forbidden occurs with every #.
    I do have the 'PBX delivers audio' box checked as well.
    Thanks again, Jeff
     
  7. StefanW

    StefanW Head of Customer Support and Training
    Staff Member 3CX Support

    Joined:
    Jun 2, 2009
    Messages:
    1,163
    Likes Received:
    74
    I only can say that forbidden you always will get if the 3cx phone systems things this call is not for it self.
    this goes along with the message of

    Unidentified incoming call. Review INVITE and adjust source identification

    in the logs.
    Most important is that the sip domain set in the pbx is matching something the pbx believe it is his.
    therefor my place your public ip into the sip domain if you validation fails. there are many steps the pbx tries to analyse if this invite is from an internal valid entity to not allow every one to make a call request via the pbx.
     
    Stop hovering to collapse... Click to collapse... Hover to expand... Click to expand...
  8. netcio

    Joined:
    Mar 27, 2009
    Messages:
    11
    Likes Received:
    0
    Where do I check the INVITE and make the proper source adjustment inside the PBX? How do ensure the IP's are authenticated properly? Where is input for sip domain set?
    Thank you all for help in solving this.
    Jeff
     
Thread Status:
Not open for further replies.