Inside Customer Network only - after phone reboot phone does not register for 15 minutes

1

Hi everybody!
I’m having an issue with a customer that I need some guidance on.

Happens only inside Customer Network, when I first boot up a phone (grandstream gpx2160 & gxp2130) it registers to my server in my datacenter (nat=yes), but after 3 minutes of being online and working properly it loses connection to my server and it goes unregistered. It stays like that (unregistered) until about 15-20 minutes then comes back online (registers & works properly) and stays online until it is rebooted (when rebooted it repeats the same process).

Its obviously something inside their network, but their IT department are having trouble finding what it is. I have 0 access to their network, but here is what I know. Each remote facility tunnels all traffic through IPSEC VPN to their datacenter where all traffic gets filtered by a PaloAlto Security appliance (they do have outbound allow rules for the ports I use (TCP 5061 TLS & UDP 10000-20000 to my public IP). They did disabled sip inspection on their local cisco firewall (that does the vpn to their datacenter).

Running FreePBX 13.0.192.19 & Current Asterisk Version: 13.17.2.

Any help is much appreciated!

2

Here is a pcap I did from one of the grandstream phones.

this is just before the phone goes unregistered:

image
image1321×163 49.7 KB

This is just before it comes back online:

image (1)
image (1)1302×200 120 KB

…in the middle of those two screenshots is all TCP Retransmissions and Dup ACK messages as you see in black…

3

Does their firewall timeout established UDP connections at or around 60 seconds? You could try setting the qualify time on an extension to something ridiculously low, like 15 seconds to try and temporarily work around the issue. If that eliminates the behavior then look for some way to increase the UDP timeout on their NAT device. I don’t think leaving qualify timeout really low is a good long term fix.

  • Nate
4

Hi Nate,
Thanks for that recommendation, we did try that already, it did not affect the problem.

5

This topic was automatically closed 365 days after the last reply. New replies are no longer allowed.