Sip alg failed with Mikrotik

[Shadi Bamalhs]

I disabled sip alg from mikrotik router but my sip alg status stll failed :

• resolving 'stun-eu.3cx.com'... done
• resolving 'stun2.3cx.com'... done
• resolving 'stun3.3cx.com'... done
• resolving 'sip-alg-detector.3cx.com'... done
• testing 3CX SIP Server... failed (How to resolve?)
  • stopping service... done
  • detecting SIP ALG... failed (How to resolve?)
  • testing port 5060... done
  • starting service... done
• testing 3CX Tunneling Proxy... done
  • stopping service... done
  • testing port 5090... done
  • starting service... done

Can any one help, i went throw all threads and i am trying to solve this issue more than one week.


here is my mikrotik setting :

[admin@MikroTik] > ip firewall filter print
Flags: X - disabled, I - invalid, D - dynamic
 0 X  chain=input action=drop protocol=udp in-interface=ether1 dst-port=53 log=no log-prefix=""

 1 X  chain=input action=drop protocol=tcp in-interface=ether1 dst-port=53 log=no log-prefix=""

 2 X  chain=input action=accept connection-state=established log=no log-prefix=""

 3 X  chain=input action=accept connection-state=related log=no log-prefix=""

 4 X  chain=forward action=accept connection-state=established log=no log-prefix=""

 5 X  chain=forward action=accept connection-state=related log=no log-prefix=""

 6 X  chain=forward action=drop connection-state=invalid log=no log-prefix=""

 7 X  chain=input action=drop in-interface=ether1 log=no log-prefix=""

 8 X  chain=input action=accept connection-state=established log=no log-prefix=""

 9 X  chain=input action=accept connection-state=related log=no log-prefix=""

10 X  chain=forward action=accept connection-state=established log=no log-prefix=""

11 X  chain=forward action=accept connection-state=related log=no log-prefix=""

12    chain=input action=accept connection-state=established

13    chain=input action=accept connection-state=related

14    chain=forward action=accept connection-state=established

15    chain=forward action=accept connection-state=related

16    chain=forward action=drop connection-state=invalid

17    chain=input action=drop in-interface=ether2 log=no log-prefix=""
[admin@MikroTik] > ip firewall nat print 
Flags: X - disabled, I - invalid, D - dynamic
 0    chain=srcnat action=masquerade out-interface=ether1 log=no log-prefix=""

 1    chain=dstnat action=dst-nat to-addresses=172.16.16.172 to-ports=5001 protocol=tcp in-interface=ether1 dst-port=5001 log=no log-prefix=""

 2    chain=dstnat action=dst-nat to-addresses=172.16.16.172 to-ports=9000-10999 protocol=udp in-interface=ether1 dst-port=9000-10999 log=no log-prefix=""

 3 X  chain=dstnat action=dst-nat to-addresses=172.16.16.134 to-ports=9000-9500 protocol=tcp in-interface=ether1 dst-port=9000-9500 log=no log-prefix=""

 4    chain=dstnat action=dst-nat to-addresses=172.16.16.172 to-ports=5060 protocol=udp in-interface=ether1 dst-port=5060 log=no log-prefix=""

 5    chain=dstnat action=dst-nat to-addresses=172.16.16.172 to-ports=5060 protocol=tcp in-interface=ether1 dst-port=5060 log=no log-prefix=""

 6    chain=dstnat action=dst-nat to-addresses=172.16.16.172 to-ports=4443 protocol=tcp in-interface=ether1 dst-port=4443 log=no log-prefix=""

 7    chain=srcnat action=masquerade src-address=192.168.60.0/24 out-interface=ether1 log=no log-prefix=""

 8 X  chain=dstnat action=dst-nat to-addresses=172.16.16.134 to-ports=9000-9099 protocol=udp in-interface=ether1 dst-port=9000-9099 log=no log-prefix=""

 9    chain=dstnat action=dst-nat to-addresses=172.16.16.172 to-ports=443 protocol=tcp in-interface=ether1 dst-port=443 log=no log-prefix=""

10 X  chain=dstnat action=dst-nat to-addresses=172.16.16.134 protocol=tcp in-interface=ether1

11 X  chain=dstnat action=dst-nat to-addresses=172.16.16.134 protocol=udp in-interface=ether1

12 X  chain=dstnat action=dst-nat to-addresses=172.16.16.134 to-ports=5000 protocol=tcp in-interface=ether1 dst-port=5000 log=no log-prefix=""

13 X  chain=dstnat action=dst-nat to-addresses=172.16.16.134 to-ports=5060 protocol=udp in-interface=ether1 dst-port=5060 log=no log-prefix=""

14    chain=dstnat action=dst-nat to-addresses=172.16.16.172 to-ports=48000-65535 protocol=udp in-interface=ether1 dst-port=48000-65535 log=no log-prefix=""

15    chain=dstnat action=dst-nat to-addresses=172.16.16.172 to-ports=5090 protocol=tcp in-interface=ether1 dst-port=5090 log=no log-prefix=""

16    chain=dstnat action=dst-nat to-addresses=172.16.16.172 to-ports=5061 protocol=tcp in-interface=ether1 dst-port=5061 log=no log-prefix=""

17    chain=dstnat action=dst-nat to-addresses=172.16.16.172 to-ports=5090 protocol=udp in-interface=ether1 dst-port=5090 log=no log-prefix=""

18 X  chain=srcnat action=masquerade out-interface=ether1 log=no log-prefix=""

19 X  chain=srcnat action=masquerade out-interface=ether1 log=no log-prefix=""

20 X  chain=srcnat action=masquerade out-interface=ether2 log=no log-prefix=""

 

[complex1]

Hi,

Please disable Service Port 5060 and try again.

/ip firewall service-port
set sip disabled=yes ports=5060

 

[Shadi Bamalhs]

Hi,

Please disable Service Port 5060 and try again.

/ip firewall service-port
set sip disabled=yes ports=5060

its disabled with same way

https://www.dropbox.com/s/zgcb3hrr17skgkd/mikrotik.JPG?dl=0

 

[Shadi Bamalhs]

I used sip-alg-detector tool too, check the result:

https://www.dropbox.com/s/pnywtltey6vjq1v/sip.JPG?dl=0

 

[complex1]

Please make sure to use the default Firewall Filter settings of the MikroTik.
I use next Firewall NAT settings to connect Internet to PBX.

 0    ;;; defconf: masquerade
      chain=srcnat action=masquerade out-interface-list=ether1 log=no log-prefix="" ipsec-policy=out,none
 1    chain=dstnat action=dst-nat to-addresses=172.16.16.172 protocol=tcp in-interface-list=ether1 dst-port=5060,5061 log=no log-prefix=""
 2    chain=dstnat action=dst-nat to-addresses=172.16.16.172 protocol=udp in-interface-list=ether1 dst-port=5060 log=no log-prefix=">>>>"
 3    chain=dstnat action=dst-nat to-addresses=172.16.16.172 protocol=udp in-interface-list=ether1 dst-port=9000-10999 log=no log-prefix=""
 4    chain=dstnat action=dst-nat to-addresses=172.16.16.172 protocol=tcp in-interface-list=ether1 dst-port=5090 log=no log-prefix=""
 5    chain=dstnat action=dst-nat to-addresses=172.16.16.172 protocol=udp in-interface-list=ether1 dst-port=5090 log=no log-prefix=""
 6    chain=dstnat action=dst-nat to-addresses=172.16.16.172 protocol=tcp in-interface-list=ether1 dst-port=5001 log=no log-prefix=""

 

[Shadi Bamalhs]

do you think this is my issue ? how to config that?

 

[complex1]

I have make a mistake when I was editing the list… Sorry.

“out-interface-list=” should be “out-interface=” and “in-interface-list=” should be “in-interface=”

 

[Shadi Bamalhs]

I have make a mistake when I was editing the list… Sorry.

“out-interface-list=” should be “out-interface=” and “in-interface-list=” should be “in-interface=”

Do You mean this "ipsec-policy=out,none" should be "in" ?

 

[complex1]

No.
Just out-interface without "-list" and in-interface without "-list", nothing else.

 

[complex1]

/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface=ether1
add action=dst-nat chain=dstnat dst-port=5060,5061 in-interface=ether1 protocol=tcp to-addresses=172.16.16.172
add action=dst-nat chain=dstnat dst-port=5060 in-interface=ether1 protocol=udp to-addresses=172.16.16.172
add action=dst-nat chain=dstnat dst-port=9000-10999 in-interface=ether1 protocol=udp to-addresses=172.16.16.172
add action=dst-nat chain=dstnat dst-port=5090 in-interface=ether1 protocol=tcp to-addresses=172.16.16.172
add action=dst-nat chain=dstnat dst-port=5090 in-interface=ether1 protocol=udp to-addresses=172.16.16.172
add action=dst-nat chain=dstnat dst-port=5001 in-interface=ether1 protocol=tcp to-addresses=172.16.16.172

 

[Shadi Bamalhs]

ok , but still the Sip-alg status failed

 

[complex1]

Probably it will not do of any help, but please reboot router and 3CX server and test again.

 

[Shadi Bamalhs]

I reboot it ,, same issue , even port 9000 not working

 

[complex1]

Just re-read your initial post again, but why are you select ether2 instead of ether1 in
17 chain=input action=drop in-interface=ether2 log=no log-prefix=""

 

[Shadi Bamalhs]

I tried both bot still same issue

 

[Shadi Bamalhs]

ether1 Internet
ether2 LAN