asterisk users - Apr 2018 - Digium IP Phones UNREACHABLE after registration

I'm trying to solve a mystery for the last couple of days.

I have a mix of D70, D50 and D40 behind NAT. Server is in a
colocation, not a VPS.

For several years, everything was working fine, no issues. A few days
ago I started having problems at one particular site. NO CHANGES have
been made to this office network - same router, switch and internet
provider. No new equipment added or configuration changed (I only
upgraded the firmware and asterisk trying to solve the problem).

A few seconds after registration, the Digium phones will become
UNREACHABLE. Right after that, the entire VoIP network (where the
Digiums are located) will be also dropped - all other devices
(non-Digium) connected will be kicked from the asterisk box. There are
ObiHai, Yealink and Linksys at this location - all will be kicked.

The server remains operational and all other users/peers (not running
Digium phones) are up and running.

Sip debug and tcpdump didn't show any relevant information to solve
the puzzle. I also replaced the router (twice, different models and
firmware versions), PoE switch and cable modem. No success. IP is
dynamic but the provider will only change it once a year. Qualify=yes
(or no) didn't fix. Removing the password (deny/permit IP) also
didn't.

Running Asterisk 13.20.0, firmware 2.6.2.

Any ideas where I should dig further?

On Thursday 12 April 2018 at 17:22:39, Hermann Wecke wrote:
> I'm trying to solve a mystery for the last couple of days.
> 
> I have a mix of D70, D50 and D40 behind NAT. Server is in a
> colocation, not a VPS.
> 
> For several years, everything was working fine, no issues. A few days
> ago I started having problems at one particular site. NO CHANGES have
> been made to this office network - same router, switch and internet
> provider. No new equipment added or configuration changed (I only
> upgraded the firmware and asterisk trying to solve the problem).
> 
> A few seconds after registration, the Digium phones will become
> UNREACHABLE. Right after that, the entire VoIP network (where the
> Digiums are located) will be also dropped - all other devices
> (non-Digium) connected will be kicked from the asterisk box. There are
> ObiHai, Yealink and Linksys at this location - all will be kicked.
Are you by any chance running fail2ban, without the IP address of this 
location in a whitelist?

I'm wondering if some device is misconfigured and failing registration,
which
get spicked up by fail2ban, and the network's public IP gets blocked.
> The server remains operational and all other users/peers (not running
> Digium phones) are up and running.
You mean, all others at other locations, right?


Antony.

-- 
A user interface is like a joke.
If you have to explain it, it means it doesn't work.

                                                   Please reply to the list;
                                                         please *don't* CC
me.

Hi Herrmann

Le 12/04/2018 ? 17:22, Hermann Wecke a ?crit?:
> I'm trying to solve a mystery for the last couple of days.
> 
> I have a mix of D70, D50 and D40 behind NAT. Server is in a
> colocation, not a VPS.
> 
> For several years, everything was working fine, no issues. A few days
> ago I started having problems at one particular site. NO CHANGES have
> been made to this office network - same router, switch and internet
> provider. No new equipment added or configuration changed (I only
> upgraded the firmware and asterisk trying to solve the problem).
> 
> A few seconds after registration, the Digium phones will become
> UNREACHABLE. Right after that, the entire VoIP network (where the
> Digiums are located) will be also dropped - all other devices
> (non-Digium) connected will be kicked from the asterisk box. There are
> ObiHai, Yealink and Linksys at this location - all will be kicked.
> 
> The server remains operational and all other users/peers (not running
> Digium phones) are up and running.
Don quite understand: above you say that all others phones are kicked 
too and here you say they are up and running ... Also, UNREACHABLE and 
kick are not the same for me.
> 
> Sip debug and tcpdump didn't show any relevant information to solve
> the puzzle.
What is relevant: do you see SIP traffic coming from those 
phones/location *AFTER* they are UNREACHABLE/kicked?

Is a fail2ban involved ?

[...]

-- 
Daniel

On Thu, Apr 12, 2018 at 11:43 AM, Antony Stone
<Antony.Stone at asterisk.open.source.it> wrote:
>> A few seconds after registration, the Digium phones will become
>> UNREACHABLE. Right after that, the entire VoIP network (where the
>> Digiums are located) will be also dropped - all other devices
>> (non-Digium) connected will be kicked from the asterisk box. There are
>> ObiHai, Yealink and Linksys at this location - all will be kicked.
>
> Are you by any chance running fail2ban, without the IP address of this
> location in a whitelist?
fail2ban: yes
whitelist: yes
> I'm wondering if some device is misconfigured and failing registration,
which
> get spicked up by fail2ban, and the network's public IP gets blocked.
If I remove the Digium phones, after a while the other devices
(brands) will register again.
>> The server remains operational and all other users/peers (not running
>> Digium phones) are up and running.
>
> You mean, all others at other locations, right?
Yes, other locations are OK. This location will be "clogged" (or
"flooded"?) and unavailable.