Remote extension unregisters - News at 11

[ian.watts]

Over the Thanksgiving holiday, I noticed my remote extension at home had the orange BLF on my Cisco SPA525G2 on the wire.

I first figured our external drive for backups screwed up the UEFI reboot on our Hyper-V 2012 R2 server at the office.. again... but no.

Fine.. rebooted my Craptiontec wifi router from Frontier on the FIOS and restarted the phone after all that came up. Today.. the logs are still showing a consistent registered/unregistered pair. It stays registered for about 210 seconds.. ish.. and back.

I do leverage the SIP ALG feature on that router.. which was fine in the past. I haven't toyed with the config in months.

Before I throw a Wireshark session to capture traffic from my home office to our 3CX host box (VM..), any ideas where it broke?
My money is on that CraptionTec. Hmm.. maybe I'll try a second handset.. or a softphone without tunnel.
Any takers?

 

[ian.watts]

Hmm.. thus far.. saw my REGISTER return 407 as expected.. without a second REGISTER with auth. Then.. some NOTIFY and SUBSCRIBE for BLFs on other extensions I added for others in the office.

A few minutes later.. another REGISTER/407 and a second REGISTER with the proxy-auth.. 200.

A few minutes later still.. more SUBSCRIBE and NOTIFY.. then the REGISTER/407 without the second REGISTER with auth.. figures. Sounds like that SIP ALG isn't doing the job.. may WireShark at home to see if the 407 response is traversing the firewall inconsistently.. hmm.

 

[ian.watts]

Sadly.. no port mirroring on that ActionTec..should have known.
All I get otherwise are the ARP broadcasts.
*sigh* Will have to rig a dual-interface tap to capture the packets.. may be a handy add to the toolset anyway.