SIP Trunk Provider reported suspicious packets sent by 3CX

[letus]

Since yesterday, our trunk provider (ISP) has been blocking our 3CX server's traffic for 5 minutes, once every 15 minutes.
After contacting the ISP, their response was "It is found your side sent suspicious UDP packets to HKT SBC which caused temporary blocking. Please stop sending the UDP and this would solve the problem."

So far we have tried updating the 3CX system, restart 3CX services, reboot 3CX instance on AWS, restore older version backup of 3CX and register the same SIP using another 3CX server that we own. but the problem persists.

Hope someone could shred some light. Thanks.

 

[YiannisH_3CX]

Hello @letus

Navigate to Settings / Network / Firewall and disable the option "Enable keep Alives". Then restart all PBX services.
This should solve the issue.

However I am not convinced that is the source of your issue. These packets are very commonly used by SIP trunk providers as a keep alive method since UDP has not active connection like TCP.

Test it and let us know.

 

[letus]

Hello @YiannisH_3CX,

In short, it works.
We ticked off "Enable keep alives" and restarted the vm on aws. Now the SIP Trunk status light is a constant green.

My colleagues and I would keep monitoring closely the status of the system for at least one more day.
Unless some other issues occur, we'll probably leave it be for now.
Thank you so so much for your help!

 

[YiannisH_3CX]

Glad I could assist.