sipgate.co.uk registration timeout (constant)

[AlecM]

Hi.
3CX Version: 3.1.2434.0 (Free).
Installed on a test PC: XP Pro SP2, 2 x P3-650's, 512Mb RAM.

I have a Sipgate.co.uk VoIP account.
On the 3CX box I have registered this VoIP line using the Sipgate pre-configured template, added my sipgate credentials, and added the outgoing dialing rule #, with mask r.

I have only seen the line "register" once - and only for a few seconds. The rest of the time it is "unregistered".

Example of what the 3CX server log indicates (I've edited out my actual number):

16:43:39.011 ClientRegs:nRequestRetry [CM113008] Registration attempt for Ln:10000@SipGate 0845 xxx xxxx is scheduled in 120 sec.
16:43:38.700 ClientRegs:nFailure [CM113010] Next registration will be attempted in 10 minutes
16:43:38.700 ClientRegs:nFailure [CM113006] Registration of sip:xxxxxxx@sipgate.co.uk has failed; reason=Request Timeout

We have a SonicWALL 2040 Pro firewall, which has been configured to allow SIP (a prebuilt rule), plus I have added the 3CX ports of 9000-9499 to this rule.

I have added the SIP DNS entries for the 3CX server to my Active Directory.

Can anyone guide me as to what might be causing the failure of the registration? (I have posted on the Sipgate help about this as well).

Thanks for any help!
Al

 

[AlecM]

I should add the we have a 2Mb managed leased line (not ADSL or cable!), so our end of the connection should not be an issue.

 

[AlecM]

Another additonal note:
After a reboot, the connection state remains unregistered, but in the running server status log, it is attempting to register almost constantly.

I presume a successful registration is indicated by:

17:35:22.943 ExtLine::Register [CM110004] Send registration for <sip:xxxxxxx@sipgate.co.uk>
17:35:22.943 ExtLine::Register [CM110001] Use External IP for device line registration DN='10000' device='SipGate 0845 xxx xxxx'

But this registration seems to fail immediately (lasting only a second or so), as the log updates a few seconds later and it's back to the Request Timeout message entry.

Should the 3CX system be continually renewing the VoIP registration? I don't see anything about this in the system guide PDF.

Thx

 

[gbarnes]

sip

Does your (firewall) sip rule include 5060?

Do not have a proxy entry with sipgate. Leave blank.

I use sipgate.co.uk and it works fine, using 5060, UDP ports 8000 - 8050, NO PROXY (ie blank) and register two-way calls.

Try looking at the 5060 port, is that set in firewall and 3cx?

Graeme.

 

[AlecM]

sip

Hi Graeme,

Thanks for your feedback. Will double-check this when back in the office next week. I know the firewall includes 5060 as I specifically checked for that. But I did have to add custom rules for the UDP ports 9000-9499. I will perhaps have to check that they are bidirectional though....

You say you're using ports 8000 - 8050. This seems to differ from the 3CX config documentation. Is this an undocumented setting, or a deliberate change on your behalf?

Al

 

[gbarnes]

9000 port

I think 9000 is the default 3cx, no I just had these ports already in the firewall, so I changed 3cx.. Nothing to worry about!

Do you have STUN set to give your real IP..

You can use the 3cx or sipgate stun server.

Let me know how you are doing?

Graeme

 

[CreativeHubLtd]

Hi AlecM

I had some registration problems with Sipgate today, this is how I resolved the problem :

"The only way I could get the Sipgate line registered was to change the setting in Line Management - Manage Gateways and Providers - Sipgate - Registration Settings - Which IP to use in 'Contact' field for registration: from External (STUN Resolved) to Both (external and internal) and the line now works fine ! "

Hope this helps

Kev

 

[AlecM]

Sipgate registration

Hi Kev,

thanks for your post- that change of setting to the Contact registration seems to have helped for me as well. The (sipgate) VoIP line is now staying registered. Just have to figure out the correct outbound rules now!

Am using the 3CX softphone for a trial, but it keeps coming back "protocol error, layer 2". If configured to use my sipgate account directly, it is quite happy, so seems it is something to do with the 3CX server config.

Alec

 

[CreativeHubLtd]

Hi Alec

Glad I have helped with part of the problem, I never changed my outgoing rule, I used the default and it worked fine, this is how mine is configured :

Rule Name : Outgoing rule for "Sipgate"
Calls to Numbers starting with : 9
VOIP Provider : Sipgate
Transform mask : r

I will download the 3CX softphone and try configuring it, I have used the SJPhone Softphone on my PDA without any problems. The extension you are configuring the softphone I assume is an internal extension ?

Kev

 

[AlecM]

3CX softphone

Hi Kev,
Yes, I've set the ssoftphone to register on an internal extension number (102 in my test case). this comes up with the green light for registered Ok. The 3CX server line status confirms this as well (along with the VoIP line registered now!).

I think I still may have issues with the firewall rules. Although I think I've configured the VOIP rules for SIP, etc as required (including ports 5060, 9000-9499, etc, etc, etc), the firewall log is saying port 5060 udp connection is dropped.

Example from log today (note USA date format):

[Date/time Priority Category Message Source Destination Note]
09/05/2007 12:11:05.224 Notice Network Access UDP packet dropped 217.10.79.23, 5060, X1 62.232.57.107, 6385, X1 UDP Port: 6385
09/05/2007 12:09:55.080 Notice Network Access UDP packet dropped 217.10.79.23, 5060, X1 62.232.57.107, 5790, X1 UDP Port: 5790

I have to confess that I'm absolutely no expert when it comes to the firewall! (SonicWALL 2040 Pro)

Al

 

[CreativeHubLtd]

Hi Alec

I have configured the 3CX softphone without any problems as an internal extension on my LAN. In your last post both the IP addresses that you list from your firewall log are public IP addresses, is your 3CX server and your softphone extension on the same LAN or is there the internet and a firewall in the middle ?

Kev

 

[AlecM]

Hi Kev,

The 3CX server and my PC using the softphone are on same LAN and subnet. In my tests, I'm simply trying to get the softphone to call my work mobile and vice-versa.

At the moment, the mobile just gets a "line busy" tone. The softphone cancels dialling after approx 30 seconds. There are two different reasons given. As previously noted, the "protocol error layer 2" occurs, but now the most common is "102:Recovery on timer expiry", where 102 is my extension.

To be thorough, I suppose I ought to add a second internal softphone installation and check I can call that extension, but at the moment I'm less concerned with that config. I would not expect the firewall to cause any issue in that case though, as the call should remain local to the 3CX server LAN.

Al

 

[CreativeHubLtd]

Hi Alec

It would be worth setting up an additional softphone on the LAN just to test extension to extension calling.

Can you send a snippet of the server log so I can see whats happening when you try to call your work mobile ?

Are you able to recieve incoming calls to your extension from your work mobile ?

Kev

 

[AlecM]

Hi Kev,

Checking the firewall log this morning, I have noted that there is a recurring process (frequency about 20 minutes) that is related. (I hadn't seen these before as the VOIP rule group wasn't originally being logged.)

To answer your other question, no, my mobile calling to my sip number is getting a line busy tone, so I'm guessing any number trying to call it will get same result.

Log extract 1 (VOIP filter):
=========

09/06/2007 09:21:07.576 Debug VOIP VoIP 10.0.0.22:5060 (SIP) Endpoint removed
2 09/06/2007 09:17:01.768 Debug VOIP VoIP 10.0.0.22:5060 (SIP) [email protected] Endpoint removed
3 09/06/2007 09:16:33.192 Debug VOIP SIP Response 217.10.79.23, 5060, X1 10.0.0.22, 5060, X0 SIP REGISTER (401 Unauthorized) ([email protected])
4 09/06/2007 09:16:33.128 Warning VOIP SIP Register expiration exceeds configured Signaling inactivity time out 10.0.0.22, 5060, X0 217.10.79.23, 5060, X1 [email protected] using expiration of 3600 secs.
5 09/06/2007 09:16:33.128 Debug VOIP SIP Request 10.0.0.22, 5060, X0 217.10.79.23, 5060, X1 SIP REGISTER ([email protected])
6 09/06/2007 09:16:07.832 Debug VOIP VoIP 10.0.0.22:5060 (SIP) Endpoint added


And also, incoming UDP packets from port 5060 still being dropped.
(X1 is our WAN interface with public IP on the firewall)
======

09/06/2007 09:43:46.128 Notice Network Access UDP packet dropped 217.10.79.23, 5060, X1 62.232.57.107, 34656, X1 UDP Port: 34656
4 09/06/2007 09:42:35.800 Notice Network Access UDP packet dropped 217.10.79.23, 5060, X1 62.232.57.107, 34656, X1 UDP Port: 34656
...
09/06/2007 09:26:54.064 Notice Network Access UDP packet dropped 217.10.79.23, 5060, X1 62.232.57.107, 33986, X1 UDP Port: 33986


I guess I'm going to have to spend more time with the firewall manual!
It's annoying, as I'm certain I've got the rules set up, but I'm obviously missing something somewhere!

The firewall allows configuration of service groups. It comes with a preconfigured VOIP service, to which I've added the 3CX UDP port range.
The rules protocol grouping is below, with my custom entry appearing last in the list. Format is description, packet type, port range:

VOIP

H323 Call Signaling TCP 1720 1720
H323 Gatekeeper Discovery UDP 1718 1718
H323 Gatekeeper RAS UDP 1719 1719
MGCP TCP TCP 2428 2428
MGCP UDP UDP 2427 2427
SIP UDP 5060 5061
Skinny TCP 2000 2000
T120 (Whiteboard+A43) TCP 1503 1503
3CX Required UDP UDP 9000 9499

There is a complementary higher-level grouping (created by the config wizard) that allows a server to host more than one set of services.

3CX-SIP Services
-> VOIP

And the associated access rule that tells the firewall to route traffic matching the above protocol grouping to our internal 3CX server.

Access Rules (WAN > LAN)
Source, Destination, Service, Action, Users
Any, WAN Primary IP, 3CX-SIP Services, Allow, All

(Destination in this case means the incoming destination from Internet, from any external source)

 

[CreativeHubLtd]

Hi Alec

Sorry I haven't replied sooner, I think you are right some more time with the manual may be required, you are almost there, I will have a closer look through you logs later when I have more time.

Kev

 

[CreativeHubLtd]

Hi Alec

Have you made any progress with this ?

Kev

 

[AlecM]

Hi Kev,

Not as yet - have some other projects to get on with.

I have progressed on the FXO side though - set up with a Grandstream GXW-4104, plus three Grandstream BT200 phones for a trial stage. This has all worked great - particularly in conjunction with Call Assistant to plug the gaps of the BT200 (primarily line and extension status).

Will hopefully be returning to the Firewall config soon though and see if I can get that (hopefully last?) step sorted.

I've been demonstrating the 3CX capabilities to my Directors and they are mighty impressed with it over our current (sometimes problematic and certainly restrictive) LG PBX, so hopefully will get more dedicated project time on it.

I will post my progess!

Al

 

[CreativeHubLtd]

Hi Alec

Glad you have progressed on the FXO side, I haven't really used that side much myself.

I now have 3 Sipgate numbers working on my server, 2 x 0845 and a local std code and all is good.

Let me know how you get on.

Kev

 

[AlecM]

Well I've made a small amount of progress.

I can make calls out from 3CX through Sipgate to an external number - e.g. my mobile. (I would guess therefore that an outward SIP to SIP will work, but haven't tested this yet.)

However, when I try the reverse path of an external number in to my Sipgate number, which should then route onwards to my 3CX server, I just get a line busy signal.

I am sure this is the firewall settings, as I'm still seeing UDP packets being dropped. I have now posted on the SonicWALL forum in hope of guidance from someone more knowledgable on that kit.

For complete coverage, I've pasted in below my firewall message, just in case anyone on this forum may be able to help.

Hi.

I not a networking specialist, so my apologies if this is a stupid question.

I am trying to get VOIP traffic through our 2040, but in the logs I am seeing the incoming UDP packets from the Sipgate service getting dropped when they reach the firewalls external IP interface.

Example
1 09/28/2007 10:15:27.720 Notice Network Access UDP packet dropped 217.10.79.23, 5060, X1 62.232.57.107, 31694, X1 UDP Port: 31694
2 09/28/2007 10:07:58.576 Notice Network Access UDP packet dropped 217.10.79.23, 5060, X1 62.232.57.107, 37775, X1 UDP Port: 37775

The UDP port changes after 18 attempts.

Inside my LAN I'm using 3CX as the IP PBX. This has a preconfigured template for connecting to Sipgate. Sipgate and 3CX both seem to report that the mutual connection is established, which is confusing me.

I've used the SonicWALL setup wizard to create the service group and NAT policies. I had to add a custom range of UDP ports for the 3CX outbound traffic (UDP 9000-9499). My config below:

Address Objects:
3CX Server
3CX Server Private

NAT Policy (custom added by wizard)
3CX-SIP Private WAN Primary IP Any Original 3CX-SIP Services Original Any X1 17
15 Any Original WAN Primary IP 3CX-SIP Private 3CX-SIP Services Original Any Any 22
16 Any Original WAN Primary IP 3CX Server VOIP Original Any Any 23

Access Rules
WAN > LAN 6 Any WAN Primary IP 3CX-SIP Services Allow All

Service Groups
3CX-SIP Services (contains) VOIP

VOIP (contains the following)
Services
H323 Call Signaling TCP 1720 1720
H323 Gatekeeper Discovery UDP 1718 1718
H323 Gatekeeper RAS UDP 1719 1719
MGCP TCP TCP 2428 2428
MGCP UDP UDP 2427 2427
SIP UDP 5060 5061
Skinny TCP 2000 2000
T120 (Whiteboard+A43) TCP 1503 1503
3CX Required UDP UDP 9000 9499

On the Connections Monitor page, when filtering to the LAN IP of the 3CX SIP server, we see the following:
1 10.0.0.22 5060 64.69.76.23 3478 UDP X0 X1 0 0
2 10.0.0.22 5060 217.10.79.23 5060 UDP X0 X1 0 506

Entry 1 is the 3CX Stun server address.
Entry 2 is the Sipgate (external) SIP service server.

Corresponding to entry 1, the 3CX server shows in its own log:
StunClient:rocess [CM215001] STUN failed to resolve external IP using server 64.69.76.23


Turning to the log, then filtering the Source IP to the SIP server, we get:

1 09/28/2007 10:08:03.128 Warning VOIP SIP Register expiration exceeds configured Signaling inactivity time out 10.0.0.22, 5060, X0 217.10.79.23, 5060, X1 [email protected] using expiration of 3600 secs.
2 09/28/2007 09:47:38.816 Warning VOIP SIP Register expiration exceeds configured Signaling inactivity time out 10.0.0.22, 5060, X0 217.10.79.23, 5060, X1 [email protected] using expiration of 3600 secs.
3 09/28/2007 09:27:26.560 Warning VOIP SIP Register expiration exceeds configured Signaling inactivity time out 10.0.0.22, 5060, X0 217.10.79.23, 5060, X1 [email protected] using expiration of 3600 secs.
4 09/28/2007 09:07:29.416 Warning VOIP SIP Register expiration exceeds configured Signaling inactivity time out 10.0.0.22, 5060, X0 217.10.79.23, 5060, X1 [email protected] using expiration of 3600 secs.
5 09/28/2007 08:47:03.560 Warning VOIP SIP Register expiration exceeds configured Signaling inactivity time out 10.0.0.22, 5060, X0 217.10.79.23, 5060, X1 [email protected] using expiration of 3600 secs.

Correspondingly on the 3CX server itself, we see:

10:10:08.425 ClientRegs:nSuccess [CM113005] Registration of sip:[email protected] is successful
10:10:08.159 ExtLine::Register [CM110004] Send registration for sip:[email protected]

Which seems at odds with what the firewall reports about registration!

This is frustrating as I seem to be so close, yet cannot get the last bit of the puzzle.

Any help gratefully received.

Thanks,

Alec

Al

 

[CreativeHubLtd]

Hi Alec

I am not suprised that you can make outgoing calls or that you have registered with Sipgate OK, as normally (I think) by default your firewall will allowing outgoing connections on any port.

Here is a full list of my incoming firewall rules :
VOIP - UDP - 5060-5062
VOIP STUN - UDP - 3478
SIPGATE STUN - UDP 10000
VOIP LINES - UDP - 9000-9007

Do you have any rules on the firewall that looks for port scans etc that say something like "if a port gets probed 5 times in 5 mins and it is not a port I have a firewall rule for then drop the packet or deny access" ?

Kev