Solved Warning: 499 "Caller is forbidden"

Discussion in '3CX Phone System - General' started by jl@rag, Dec 4, 2017.

Thread Status:
Not open for further replies.
  1. jl@rag

    Joined:
    Dec 4, 2017
    Messages:
    9
    Likes Received:
    0
    Hi,

    I got the newest 3CX PBX Pro Edition installed on Debian 9. We do have 4 NICs installed, eth0 for WAN and eth1 for LAN. eth2&3 not used yet, and not configured.

    eth0: WAN IP
    eth1: 10.2.2.1 without default gateway

    Extension 251 IP: 10.2.2.3

    ISC DHCP Server is running on the system, with option 68 for auto-provisioning. This works perfectly.

    Now when I try to call someone, it doesn't matter if it's another extension or an external number, I get the error 499 "Caller is forbidden". Here is a tcpdump from a call that was from extension 251 to 278:

    attached text file: tcpdump_caller_forbidden.txt

    Here is the log from the 3CX:

    Code:
    12/04/2017 8:38:38 AM - Leg L:13.1[Unknown:] is terminated: Cause: BYE from PBX
    12/04/2017 8:38:38 AM - [CM503013]: Call(C:13): Incoming call rejected, caller is unknown; msg=Invite-IN Recv Req INVITE from 10.2.2.3:5060 tid=1091939237 Call-ID=0_308375904@10.2.2.3:
    INVITE sip:278@10.2.2.1:5060 SIP/2.0
    Via: SIP/2.0/UDP 10.2.2.3:5060;branch=z9hG4bK1091939237
    Max-Forwards: 70
    Contact: <sip:251@10.2.2.3:5060>
    To: <sip:278@10.2.2.1:5060>
    From: "John Doe"<sip:251@10.2.2.1:5060>;tag=298142155
    Call-ID: 0_308375904@10.2.2.3
    CSeq: 2 INVITE
    Allow: INVITE, INFO, PRACK, ACK, BYE, CANCEL, OPTIONS, NOTIFY, REGISTER, SUBSCRIBE, REFER, PUBLISH, UPDATE, MESSAGE
    Content-Type: application/sdp
    Proxy-Authorization: Digest username="xXxXxXx",realm="3CXPhoneSystem",nonce="414d53595a24fb7e43:90371c13dccee7642933c939f6000206",uri="sip:278@10.2.2.1:5060",response="fc5583b28c6a9c9d071b78b8a76d2e1c",algorithm=MD5
    Supported: replaces
    User-Agent: Yealink SIP-T46S 66.82.0.20
    Allow-Events: talk, hold, conference, refer, check-sync
    Content-Length: 298
    
    v=0
    o=- 20020 20020 IN IP4 10.2.2.3
    s=SDP data
    c=IN IP4 10.2.2.3
    t=0 0
    m=audio 12568 RTP/AVP 0 8 9 18 101
    a=rtpmap:0 PCMU/8000
    a=rtpmap:8 PCMA/8000
    a=rtpmap:9 G722/8000
    a=rtpmap:18 G729/8000
    a=fmtp:18 annexb=no
    a=ptime:20
    a=sendrecv
    a=rtpmap:101 telephone-event/8000
    a=fmtp:101 0-15
    Extension 278 is not provisioned via 3CX. It is connected via WAN and just SIP Username/Password. Extension 278 can call 251 but 251 can't call back. 251 can call nothing, not even other auto-provisioned phones. Other auto-provisioned phones can't call neither.

    Every phone is a Yealink T46S.

    BUT when I use the 3CX Windows Client in Softphone mode, I can call whatever I want.

    Do you need any further information?
    I just need to know why the 3CX PBS sends the Code 499/"Caller is unknown" and how I can prevent this.

    Thank you.

    JL
     

    Attached Files:

  2. YiannisH_3CX

    YiannisH_3CX Support Team
    Staff Member 3CX Support

    Joined:
    May 10, 2016
    Messages:
    6,326
    Likes Received:
    448
    Hello @jl@rag

    What IP did you use as local when installing the system and what is the IP specified for under the extension settings / Phone provisioning?
    Do you have a working invite from a client you can share so we can see what is different?
     
  3. jl@rag

    Joined:
    Dec 4, 2017
    Messages:
    9
    Likes Received:
    0
    Hi,

    when installing I already had the WAN IP configured on eth0, so I chose this as IP.
    In the extension settings there is the 10.2.2.1 IP as provisioning. My link for auto-provision is like
    http://10.2.2.1:5000/provisioning/XXXXXXXXXX
    That is what my dhcp server propagades, and it works.

    You want a working INVITE from a call I made with softphone? When I do this, I do come from an external IP via NAT and I do connect to my domain/WAN IP. External phones are the only working phones. See attachment tcpdump_caller_working_invite.txt

    Here is my ip route show

    default via 202.196.71.33 dev br0 onlink
    10.2.2.0/24 dev eth1 proto kernel scope link src 10.2.2.1
    202.196.71.32/27 dev br0 proto kernel scope link src 202.196.71.54

    And my ip add:

    1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
    valid_lft forever preferred_lft forever
    2: ens1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast master br0 state UP group default qlen 1000
    link/ether d8:df:0d:03:70:01 brd ff:ff:ff:ff:ff:ff
    3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq master br0 state UP group default qlen 1000
    link/ether 30:e1:71:6c:17:3c brd ff:ff:ff:ff:ff:ff
    4: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 30:e1:71:6c:17:3d brd ff:ff:ff:ff:ff:ff
    inet 10.2.2.1/24 brd 10.2.2.255 scope global eth1
    valid_lft forever preferred_lft forever
    inet6 fe80::32e1:71ff:fe6c:173d/64 scope link
    valid_lft forever preferred_lft forever
    5: eth2: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether 30:e1:71:6c:17:3e brd ff:ff:ff:ff:ff:ff
    6: eth3: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN group default qlen 1000
    link/ether 30:e1:71:6c:17:3f brd ff:ff:ff:ff:ff:ff
    7: br0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 30:e1:71:6c:17:3c brd ff:ff:ff:ff:ff:ff
    inet 202.196.71.54/27 brd 202.196.71.63 scope global br0
    valid_lft forever preferred_lft forever
    inet6 fe80::32e1:71ff:fe6c:173c/64 scope link
    valid_lft forever preferred_lft forever

    interface ens1 is a beronet Gateway with ISDN Ports with IP 202.196.71.56

    WAN IP addresses are altered.
     

    Attached Files:

  4. YiannisH_3CX

    YiannisH_3CX Support Team
    Staff Member 3CX Support

    Joined:
    May 10, 2016
    Messages:
    6,326
    Likes Received:
    448
    Your issue probably arises from the fact the your local Sip domain does not match what the local phones are sending as you chose the public IP during installation and the PBX does not recognise the source of the call.

    Read point 9 of the following guide: https://www.3cx.com/docs/manual/configuring-your-pbx/

    You should perform a backup without licence and FQDN un-install the system and re-install it selecting your local IP (without gateway) and after the installation switch the network interface to the public from Settings / Network / Select Network Card interface.
     
  5. jl@rag

    Joined:
    Dec 4, 2017
    Messages:
    9
    Likes Received:
    0
    So even if it says "public IP address" while installation I should use the 10.2.2.1 interface?
    What about my domain configuration? Should I point the A-Record of my domain to 10.2.2.1 or the real public IP 202.196.71.54?
     
  6. YiannisH_3CX

    YiannisH_3CX Support Team
    Staff Member 3CX Support

    Joined:
    May 10, 2016
    Messages:
    6,326
    Likes Received:
    448
    When the Installation asks for your Public IP select the NIC with the WAN IP. Then for local IP select your local IP. After the installation is complete switch the network interface to the public from Settings / Network / Select Network Card interface. This way the local extension will connect to the local IP. If you are using your own domain that should point to the public IP for remote extensions to work.
     
  7. jl@rag

    Joined:
    Dec 4, 2017
    Messages:
    9
    Likes Received:
    0
    Ok, this was the solution. I reinstalled 3CX with backup. Now everything works.
    I think it was because I installed the beronet Gateway PCIe Card after the 3CX installation.
     
  8. YiannisH_3CX

    YiannisH_3CX Support Team
    Staff Member 3CX Support

    Joined:
    May 10, 2016
    Messages:
    6,326
    Likes Received:
    448
    Glad to hear the issue is resolved and thank you for sharing your solution.
     
Thread Status:
Not open for further replies.