Unclear behaviour between linksys SPA942 and 3CX

[spaxton]

Dear friends,

Recently I have installed 3CX on a server in my company in order to test it and prepare for migration to 3CX. There are 14 IP phones. 12 HTek UC924 and only 2 of them linksys SPA942 and this existing phonesystem which is now on FreePBX is in a different subnet but traffic between subnet where 3CX is installed and existing phone system is allowed.
While nothing is configured on the phones for new installation of 3CX, I have received an email two times that IP addresses of Linksys phones were blacklisted because of too many tries for registration.
Here is the text I got via email:

"
IP 10.213.8.192 has been blacklisted on PBX xxxxx.my3cx.de.
Affected Module: SIP Server/Call Manager
User agent: Linksys/SPA942-6.1.5(a)

The IP 10.213.8.192 has been blacklisted for 86400 seconds. (Expires at: 2019/05/02 22:54:49).
Reason: Too many failed authentications! This IP Address has made numerous attempts to authenticate with 3CX with invalid authentication details. Therefore a blacklist rule has been created denying this IP to continue sending requests.

To delete this rule, login to the 3CX Management console > Dashboard > IP Blacklist. Enter this IP Address 10.213.8.192 in the search field and delete the entry.

You can whitelist the IP or you can permanently block this IP or the whole subnet it belongs to.

Visit this url for more information on black/white listing https://www.3cx.com/docs/allow-deny-ip-addresses/
"

The addresses were blocked and can see them in 3CX control panel but I have no idea how could this happen... The phones are regularly registered and functioning on the existing phone system for almost 2 years.

Does anyone have a clue on how and why did this happen?

Best Regards.

 

[craigreilly]

So you are saying the phones are registered on 3cx in 1 moment...
But then suddenly get blacklisted?

 

[spaxton]

So you are saying the phones are registered on 3cx in 1 moment...
But then suddenly get blacklisted?

Hello. Thanks for replying!

No, the phones were not even configured to register on 3CX. Absolutely nothing about 3CX in the phones and never was. 3CX was installed yesterday but it reported two blacklisted IP addresses of two phones which are successfully registered on another phone system from another subnet (traffic between subnets is not restricted).

How could this happen?

 

[leejor]

...and the IP address listed, is from that location?

 

[spaxton]

...and the IP address listed, is from that location?

The IP address listed is the Linksys SPA942 address. Yes, from that location just different subnet from the 3CX server.

 

[leejor]

As i recall, that set has a GUI. Have you logged in locally and examined all of the linekey datafill? The set won't attempt to register with 3CX (it's IP/FQDN) unless instructed to. Have you narrowed it down to one of the two sets (power down both, then power up one at a time and check the Activity Log) ?

 

[spaxton]

As i recall, that set has a GUI. Have you logged in locally and examined all of the linekey datafill? The set won't attempt to register with 3CX (it's IP/FQDN) unless instructed to. Have you narrowed it down to one of the two sets (power down both, then power up one at a time and check the Activity Log) ?

Hello. Thanks for reply!!

No, the two devices mentioned above are NOT instructed to initiate any registration to the new installation of 3CX. Only one account is configured on them and that account is successfully registered to another IP PBX which is not 3CX. Their PBX is at 10.213.8.50 while 3CX is at 10.213.3.140 .
What You said is logical and thats what I thought at first and immediately checked the configuration via web interface.
I know that this problem is not coming from 3CX but I thought someone here may know how could this happen.
By the way... no access from outside to Linksys devices is configured.

Best regards.

 

[[email protected]]

We have several SPA942 configured on our 3CX as well. Last night, one of the units suddenly was blacklisted by 3CX. That unit was working properly for years. No exposed units to the internet. We will be reviewing logs to determine if there was any unauthorized access of any kind. we'll report back findings, but this is highly suspect. There were no updates done either to the 3CX or the SPA942 units.

 

[spaxton]

We have several SPA942 configured on our 3CX as well. Last night, one of the units suddenly was blacklisted by 3CX. That unit was working properly for years. No exposed units to the internet. We will be reviewing logs to determine if there was any unauthorized access of any kind. we'll report back findings, but this is highly suspect. There were no updates done either to the 3CX or the SPA942 units.

Thanks for sharing this! I also suspect on SPA942 (can it be some modified firmware in it???). There were no unauthorized access to it (at least we didn't notice any) and in our case SPA942 wasn't even configured to register to 3CX. The 3CX PBX was just available in the network, no configuration in the phones for it. So far, only phones configured for 3CX are several Android softphones and one SPA922 which is far away in the remote office and it was added yesterday.

Best Regards.

 

[leejor]

If it is the phone doing this, then there has to be something that instigates it. The set doesn't just decide do this on its own. Could it be set to download a configuration file from a server (option 66), and that happens to be 3CX?

Going into the set menu, and examining the line keys settings, will show whether or not, any of them are configured to register to the 3CX server IP. Software upgrades and auto configuration can be disabled, on the set, if this is a concern

 

[spaxton]

If it is the phone doing this, then there has to be something that instigates it. The set doesn't just decide do this on its own. Could it be set to download a configuration file from a server (option 66), and that happens to be 3CX?

Friend,

I am not sure if You have seen my previous messages...
3CX server was installed on tuesday this week. SPA942 was NEVER configured to access that 3CX server, it is a part of other phone system which is based on FreePBX. SPA942 has no idea (if we consider its configuration) what is the IP address of 3CX.
For me, this is inexplicable for now.

Best Regards,

 

[[email protected]]

We could not find any indication of intrusion on our network. SP942's don't have any access logs. Going to see if we track packets too and from it. Went through all available logs on 3CX and could not find any anomalies. I removed the blacklist on the phone, and it registered correctly ... which means the credentials stored on the phone and the 3CX match. We will see if it drops again. We'll also try to identify any spoofing on the network from any other source. As a reference, I found this entry from 2019-02-11. https://www.abuseipdb.com/check/185.53.88.16

Although we are not exposed to the internet, it doesn't rule out that there could be a vulnerability or some other element anywhere on our network that could be spoofing it's internal IP or device ID.

we'll report back our findings if any.

 

[leejor]

We have several SPA942 configured on our 3CX as well. Last night, one of the units suddenly was blacklisted by 3CX. That unit was working properly for years.

I've had similar experiences (a few years back) using several models of Cisco/Linksys ATAs. All of a sudden, one would be blacklisted, here or there because the password was not correct. It happened randomly over a couple of installations. I finally had to whitelist my local network. Not saying it's the same issue in your case, and would not whilelist the whiole network if there are valid security concerns, but even devices that should not be causing problems, sometimes can, with no changes made on the device. Mine were/are manually provisioned and not set to auto-update the configuration file.

 

[[email protected]]

Thanks Leejor for your input. We did another sweep through logs, etc and could not find any anomalies.

Like you, we have our phones manually configured. We were hoping to come across some concrete evidence for this white listing event, but alas, we may have to chalk it up to a glitch (it happens as you pointed out).

This phone has not been rebooted in 2+ years, our LAN has a few platforms that regularly do LAN broadcasts, and we have not upped the firmware on these units in a very long time ... so all could have had some level of contribution to the problem.

We aren't going to make any changes to the configuration as it stands now in the event that this may occur again ... which may hopefully leave some trace somewhere as to the root cause.

 

[leejor]

I never did find a reason that this was happening and assumed I never would. For all I know, the ATAs are still failing to register, on occasion, but they no longer get blacklisted. If it had been happening on a more "predictive" schedule, and more than once every few weeks, I probably would have spent more time trying to track down the reason.