Outgoing calls from remote phones - Forbidden

[netcio]

3CX V11
I'm having trouble calling out from remote phones. The # dials, then immediately produces Forbidden on the console. This does this with physical phones and the 3CXPhone for Windows which I installed to do some testing. Incoming calls connect, but the audio does not work.
I think if I can get the outgoing calls to connect, the audio piece will work itself out.

Set up verbose logging as per one blog or post I read and here is the log from one of the calls, call made to *777 per blog post:
<Public IP removed>

20-Jul-2013 10:27:58.340 [CM500002]: Unidentified incoming call. Review INVITE and adjust source identification:
Invite-UNK Recv Req INVITE from <Public IP of PBX>:59898 tid=d561ec638c740a26 Call-ID=NjA3NTU5ZGYwZTJhZjY2YTg2NjE0MTNhNmIxNjFjNWY.:
INVITE sip:3610307@<Public IP of PBX>:5060 SIP/2.0
Via: SIP/2.0/UDP 192.168.168.34:59898;branch=z9hG4bK-d8754z-d561ec638c740a26-1---d8754z-;rport=59898;received=<Public IP of PBX>
Max-Forwards: 70
Contact: <sip:101@<Public IP of PBX>:59898;transport=UDP>
To: <sip:3610307@<Public IP of PBX>:5060>
From: "Jeff"<sip:101@<Public IP of PBX>:5060>;tag=c3145a5d
Call-ID: NjA3NTU5ZGYwZTJhZjY2YTg2NjE0MTNhNmIxNjFjNWY.
CSeq: 1 INVITE
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REGISTER, SUBSCRIBE, NOTIFY, REFER, INFO, MESSAGE
Content-Type: application/sdp
Supported: replaces
User-Agent: 3CXPhone 6.0.26523.0
Content-Length: 284
X-Dc: PHNpcDoxMDFAMTc0Ljc3LjE2NC4xMjQ6NTk4OTg7dHJhbnNwb3J0PVVEUD4=
X-Dv: U0lQLzIuMC9VRFAgMTkyLjE2OC4xNjguMzQ6NTk4OTg7YnJhbmNoPXo5aEc0YkstZDg3NTR6LWQ1NjFlYzYzOGM3NDBhMjYtMS0tLWQ4NzU0ei07cnBvcnQ=
X-Dsa: MTc0Ljc3LjE2NC4xMjQ=
X-Damp: NDAwMTI=

v=0
o=3cxVCE 358782735 238678230 IN IP4 <Public IP of PBX>
s=3cxVCE Audio Call
c=IN IP4 <Public IP of PBX>
t=0 0
m=audio 40012 RTP/AVP 0 8 3 101
a=rtpmap:0 PCMU/8000
a=rtpmap:8 PCMA/8000
a=rtpmap:3 GSM/8000
a=rtpmap:101 telephone-event/8000
a=fmtp:101 0-15
a=ptime:20
a=sendrecv
20-Jul-2013 10:17:43.877 Leg L:3.1[Unknown:] is terminated: Cause: BYE from PBX
20-Jul-2013 10:17:43.832 [CM502001]: Source info: From: "Jeff"<sip:101@<Public IP of PBX>:5060>;tag=7943c474; To: <sip:*777@<Public IP of PBX>:5060>
20-Jul-2013 10:17:43.832 [CM503013]: Call(C:3): Incoming call rejected, caller is unknown; msg=Ivite-IN Recv Req INVITE from <Public IP of PBX>:59898 tid=4968fa49d10eb624 Call-ID=YmIyZTg2ZmIzMjJhN2FmNGI1MzZiZjdkOWRjMmE2ZWY.:
INVITE sip:*777@<Public IP of PBX>:5060 SIP/2.0
Via: SIP/2.0/UDP 192.168.168.34:59898;branch=z9hG4bK-d8754z-4968fa49d10eb624-1---d8754z-;rport=59898;received=<Public IP of PBX>
Max-Forwards: 70
Contact: <sip:101@<Public IP of PBX>:59898;transport=UDP;rinstance=91a7ebd7db281aee>
To: <sip:*777@<Public IP of PBX>:5060>
From: "Jeff"<sip:101@<Public IP of PBX>:5060>;tag=7943c474
Call-ID: YmIyZTg2ZmIzMjJhN2FmNGI1MzZiZjdkOWRjMmE2ZWY.
CSeq: 2 INVITE
Allow: INVITE, ACK, CANCEL, OPTIONS, BYE, REGISTER, SUBSCRIBE, NOTIFY, REFER, INFO, MESSAGE
Content-Type: application/sdp
Proxy-Authorization: Digest username="101",realm="3CXPhoneSystem",nonce="414d535c07fb573726:8936cd876147f1931cc0d9d94cec7606",uri="sip:*777@<Public IP of PBX>:5060",response="0c1575b660949e0d84d0177bc4001e8a",algorithm=MD5
Supported: replaces
User-Agent: 3CXPhone 6.0.26523.0
Content-Length: 284
X-Dc: PHNpcDoxMDFAMTc0Ljc3LjE2NC4xMjQ6NTk4OTg7dHJhbnNwb3J0PVVEUDtyaW5zdGFuY2U9OTFhN2ViZDdkYjI4MWFlZT4=
X-Dv: U0lQLzIuMC9VRFAgMTkyLjE2OC4xNjguMzQ6NTk4OTg7YnJhbmNoPXo5aEc0YkstZDg3NTR6LTQ5NjhmYTQ5ZDEwZWI2MjQtMS0tLWQ4NzU0ei07cnBvcnQ=
X-Dsa: MTc0Ljc3LjE2NC4xMjQ=
X-Damp: NDAwMTA=

I'm looking for some deeper instructions on anything related to authentication, as I <think> that is what's causing the connection from external outbound.
Thanks for any help/insight.
Jeff

 

[leejor]

A couple of points when using external extensions.

You have to specifically enable that function in the (each) extension options (allow this extension to register from outside the LAN).

You've hidden the actual public IP of the server (a good thing), but I can't tell if you are actually sending to an IP or a URL. If the remote set is sending to a URL, that "name" must be in datafilled 3CX as the Domain Name or calls will be rejected.



You don't mention if the remote set is registering correctly, or you are simply attempting a call without registration.

You also don't say which receives gets no audio. That may give a clue as to what is happening too.

 

[netcio]

Hi Leejor
Thanks for the reply.
I have enabled that function for each extension in the 3CX console.
I'm using the actual IP address, I do have an A record setup, but have found that the IP is easier to use.
Both remotes have registered in the 3CX and they both can initiate a call, even appears that on the 3CX softphone, it will ring once before it receives the Forbidden. The Forbidden happens immediately on the physical phone.
The both get no audio, although when I connected to the physical phone via my cell phone the connection stayed alive. No audio either way.
Appreciate the help!
Jeff

 

[leejor]

You have replaced everything with public IP of PBX, but some of the IP's must be from the originating end, either the Public or private.

Have you successfully run the firewall checker on 3CX?

Confirmed that the remote IP is not in the IP blacklist?

Tried using the set at another location? (behind another router)

I'm assuming that the "forbidden" is occurring for every number dialled.

 

[jpillow]

under the extensions tab--->Phone provisioning--->and check the box marked pbx delivers audio, that may help with the one way audio issue, give it a try I hope it works out for you.

 

[netcio]

I left the private IP's visible in the log, I only removed the public IP, where applicable.
Have successfully run the firewall checker.
Have not checked the IP blacklist, will do that as soon as I get back on system.
Also have not tried at another location.
Forbidden occurs with every #.
I do have the 'PBX delivers audio' box checked as well.
Thanks again, Jeff

 

[StefanW]

I only can say that forbidden you always will get if the 3cx phone systems things this call is not for it self.
this goes along with the message of

Unidentified incoming call. Review INVITE and adjust source identification

in the logs.
Most important is that the sip domain set in the pbx is matching something the pbx believe it is his.
therefor my place your public ip into the sip domain if you validation fails. there are many steps the pbx tries to analyse if this invite is from an internal valid entity to not allow every one to make a call request via the pbx.

 

[netcio]

Where do I check the INVITE and make the proper source adjustment inside the PBX? How do ensure the IP's are authenticated properly? Where is input for sip domain set?
Thank you all for help in solving this.
Jeff