asterisk users - Mar 2018 - Client Asterisks can't connect when main Asterisk reboot

Hi all,

we are running some Asteriks (version 13 on Debian Stretch) as VM/kvm in 
datacenter and have trunks with other Asterisk (v1.8 11 or 13) instances 
behind FW. Problem we face is that when we reboot the DC Asterisks, the 
trunks (SIP or IAX) become alive from DC Asterisks to clients ones but 
UNAVAILABLE the other way.

In clients logs we see

Registration for 'XXX at ourDCAsteriks' timed out, trying again (Attempt
#5550)

or UNREACHABLE in case of no registration or IAX

Sometimes a restart from client Asterisks is enough (SIP or IAX reload 
has no effect) to recover the full trunk, but in most cases we have to 
reboot the client server :(

If we use a VPN (OpenVPN) between Asterisks, no problem.

What can be the problem ?

-- 
Daniel

On Monday 26 March 2018 at 10:58:01, Administrator TOOTAI wrote:
> Hi all,
> 
> we are running some Asteriks (version 13 on Debian Stretch) as VM/kvm in
> datacenter and have trunks with other Asterisk (v1.8 11 or 13) instances
> behind FW. Problem we face is that when we reboot the DC Asterisks, the
> trunks (SIP or IAX) become alive from DC Asterisks to clients ones but
> UNAVAILABLE the other way.
> 
> In clients logs we see
> 
> Registration for 'XXX at ourDCAsteriks' timed out, trying again
(Attempt
> #5550)
> 
> or UNREACHABLE in case of no registration or IAX
> 
> Sometimes a restart from client Asterisks is enough (SIP or IAX reload
> has no effect) to recover the full trunk, but in most cases we have to
> reboot the client server :(
> 
> If we use a VPN (OpenVPN) between Asterisks, no problem.
> 
> What can be the problem ?
Are you doing NAT between the two servers?  Your comment about using a VPN 
makes me think you probably are.

In that case I suggest the problem is with stale connection tracking table 
entries on the machine which is doing the NAT.


Regards,


Antony.

-- 
I thought I had type A blood, but it turned out to be a typo.

                                                   Please reply to the list;
                                                         please *don't* CC
me.

Le 26/03/2018 ? 11:08, Antony Stone a ?crit?:
> On Monday 26 March 2018 at 10:58:01, Administrator TOOTAI wrote:
> 
>> Hi all,
>>
>> we are running some Asteriks (version 13 on Debian Stretch) as VM/kvm
in
>> datacenter and have trunks with other Asterisk (v1.8 11 or 13)
instances
>> behind FW. Problem we face is that when we reboot the DC Asterisks, the
>> trunks (SIP or IAX) become alive from DC Asterisks to clients ones but
>> UNAVAILABLE the other way.
>>
>> In clients logs we see
>>
>> Registration for 'XXX at ourDCAsteriks' timed out, trying again
(Attempt
>> #5550)
>>
>> or UNREACHABLE in case of no registration or IAX
>>
>> Sometimes a restart from client Asterisks is enough (SIP or IAX reload
>> has no effect) to recover the full trunk, but in most cases we have to
>> reboot the client server :(
>>
>> If we use a VPN (OpenVPN) between Asterisks, no problem.
>>
>> What can be the problem ?
> 
> Are you doing NAT between the two servers?  Your comment about using a VPN
> makes me think you probably are.
Yes, NAT is involved.
> 
> In that case I suggest the problem is with stale connection tracking table
> entries on the machine which is doing the NAT.
OK, effectively the clients having problems are behind ISP boxes which 
means poor NAT level :( Others behind linux boxes (except one behind 
Sophos UTM) doesn't have this problem.

Thanks for your enlightenment.

Daniel