This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

VoIP helper: SIP works, but no RTP...

Hi there,

after years of using Astaro (since V3.1) I have now a problem which
I have not solved yet (Version 9.204-20).
End of this week our phone line will be switched to IP (VoIP). Therefor I prepare the UTM for this day and want to test it with a sipgate.de account. The internal PBX is a Starface. VoIP Support is enabled and all Sipgate servers and the IP of the local PBX is entered correctely at the VoIP Support
page. (Strict mode)
Internet access with PPPoE from the UTM.

With wireshark I inspected the packets on the pbx going to the UTM:
registering and dialing is working as expected. Phones are ringing but no tone is going in any direction!
The Ports stated in the SIP-Session description are used by the pbx for outgoing RTP. But UTM is blocking them all. (Default DROP)
Strange thing: Outgoing packets are marked as 'UDP' - Default DROP ; Incoming packets are marked as 'RTP' - Default DROP. Wireshark shows the outgoing packets as RTP and not as UDP... Is the helper not recognising the RTP packets correctely?

If I enter a Firewall rule (PBX -> AllSipgateServer -> Any) everything works fine - but I do not want to have an 'ANY' Rule in the list...

What's going wrong here?

Thanks for your help in advance

Marc

This thread was automatically locked due to age.

0 RFCat_vk_01 over 9 years ago

Hi and welcome,
what settings do you have in the SIP protocol support?

Ian
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 9 years ago

Also, please show the relevant lines from the full Firewall log file (not the Live Log).

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 marcB72 over 9 years ago

Thank you for willing to help!

of course SIP Support is enabled:
under the Server networks is one group which contains all known servers of sipgate.de
(sipgate team - Hilfe - Sicherheitseinstellungen: IP/Port Bereiche, Allgemeine Hinweise)
uner SIP client is only the host with the starface entered.
The Mode is set to strict - before that I got several warnings from Starface that someone tired to login with invalid username/password!

Here the SIP SessionDescription (Wireshark on Starface):

Frame 1313 (829 bytes on wire, 829 bytes captured)
Ethernet II, Src: Vmware_ef:a5:bf (00:0c:29:ef:a5:bf), Dst: Vmware_93[:D]2:5b (00:0c:29:93[:D]2:5b)
Internet Protocol, Src: 192.168.20.22 (192.168.20.22), Dst: 217.10.79.9 (217.10.79.9)
User Datagram Protocol, Src Port: sip (5060), Dst Port: sip (5060)
Session Initiation Protocol
    Request-Line: INVITE sip:0177*******@sipgate.de SIP/2.0
    Message Header
    Message Body
        Session Description Protocol
            Session Description Protocol Version (v): 0
            Owner/Creator, Session Id (o): root 1252 1252 IN IP4 217.255.225.209
            Session Name (s): session
            Connection Information (c): IN IP4 217.255.225.209
            Time Description, active time (t): 0 0
            Media Description, name and address (m): audio 13448 RTP/AVP 8 0 101
                Media Type: audio
                Media Port: 13448
                Media Protocol: RTP/AVP
                Media Format: ITU-T G.711 PCMA
                Media Format: ITU-T G.711 PCMU
                Media Format: DynamicRTP-Type-101
            Media Attribute (a): rtpmap:8 PCMA/8000
            Media Attribute (a): rtpmap:0 PCMU/8000
            Media Attribute (a): rtpmap:101 telephone-event/8000
            Media Attribute (a): fmtp:101 0-16
            Media Attribute (a): ptime:20
            Media Attribute (a): sendrecv
--------------------
Frame 1349 (906 bytes on wire, 906 bytes captured)
Ethernet II, Src: Vmware_93[:D]2:5b (00:0c:29:93[:D]2:5b), Dst: Vmware_ef:a5:bf (00:0c:29:ef:a5:bf)
Internet Protocol, Src: 217.10.79.9 (217.10.79.9), Dst: 192.168.20.22 (192.168.20.22)
User Datagram Protocol, Src Port: sip (5060), Dst Port: sip (5060)
Session Initiation Protocol
    Status-Line: SIP/2.0 183 Session Progress
    Message Header
    Message Body
        Session Description Protocol
            Session Description Protocol Version (v): 0
            Owner/Creator, Session Id (o): root 657403110 657403110 IN IP4 217.10.67.136
            Session Name (s): sipgate VoIP GW
            Connection Information (c): IN IP4 217.10.67.136
            Time Description, active time (t): 0 0
            Media Description, name and address (m): audio 20230 RTP/AVP 8 0 101
                Media Type: audio
                Media Port: 20230
                Media Protocol: RTP/AVP
                Media Format: ITU-T G.711 PCMA
                Media Format: ITU-T G.711 PCMU
                Media Format: DynamicRTP-Type-101
            Media Attribute (a): rtpmap:8 PCMA/8000
            Media Attribute (a): rtpmap:0 PCMU/8000
            Media Attribute (a): rtpmap:101 telephone-event/8000
            Media Attribute (a): fmtp:101 0-16
            Media Attribute (a): silenceSupp[:$]ff - - - -
            Media Attribute (a): ptime:20
            Media Attribute (a): sendrecv

And the following lines are repeated several hundred times on the astaro firewall log:

2014:07:24-20:53:10 gw ulogd[4746]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60001" initf="ppp0" mark="0x31a7" app="423" srcip="217.10.67.136" dstip="217.255.225.209" proto="17" length="200" tos="0x18" prec="0x00" ttl="57" srcport="20230" dstport="13448"

2014:07:24-20:53:10 gw ulogd[4746]: id="2001" severity="info" sys="SecureNet" sub="packetfilter" name="Packet dropped" action="drop" fwrule="60002" initf="eth0" outitf="ppp0" srcmac="0:c:29:ef:a5:bf" dstmac="0:c:29:93[:D]2:5b" srcip="192.168.20.22" dstip="217.10.67.136" proto="17" length="200" tos="0x18" prec="0xa0" ttl="63" srcport="13448" dstport="20230"

I have no idea whats going wrong here...

Thanks for any help :-)

fortunately the switchover to VoIP is postponed to next week ...

Best Regards
Marc
Cancel
Vote Up 0 Vote Down

Cancel
0 marcB72 over 9 years ago

... after some debugging on the UTM-console:

is there something wrong with the conntracker?

conntrack -E gives no VoIP corresponding entries! even after
a reboot of the pbx - just nothing - yust some dns querries (port 53)

lsmod shows nf_conntrack_sip and nf_nat_sip are loaded.

conntrackd is not running - the configfile is not configured
is it not neccessary to have conntrackd running??

Anyone any idea?

Thanks a lot
M. Brandt
Cancel
Vote Up 0 Vote Down

Cancel
0 NewImage over 9 years ago

My UTM 110 did the same thing, after the 9.204 update from 9.103 my RTvP stopped working for one of my trunks, I can call in but cant call out. I have 9.204 working great on 2 other of my UTMs but this one has the PBX on a different subnet then the phones, dont know if that could be the issue.

Edit---------

Next day it just magically just starts working
Cancel
Vote Up 0 Vote Down

Cancel
0 BAlfson over 9 years ago

OK, it looks like the packet capture saw the SIP (5060) discussion that agreed on the necessary ports for the UDP voice stream, but the SIP Helper didn't allow the RTP traffic. I think that worked in earlier versions, so ou should definitely get Sophos Support involved if this is a paid license.

As a workaround, create a Service "Sipgate RTP" = "1:65535->15000:30000" and a firewall rule '{PBX} -> Sipgate RTP -> {Sipgate servers} : Allow'.

Cheers - Bob

Sophos UTM Community Moderator
Sophos Certified Architect - UTM
Sophos Certified Engineer - XG
Gold Solution Partner since 2005

MediaSoft, Inc. USA
Cancel
Vote Up 0 Vote Down

Cancel
0 NewImage over 9 years ago

I have another remote office where updating to 9.204 broke voice over Trunk line.
Cancel
Vote Up 0 Vote Down

Cancel
0 NewImage over 9 years ago

Yeah, the SIP Helper does not seem to be opening RTVP ports for sip calls correctly.
I had to add NAT rule. PBX -> ( RTVP udp ports) -> Any Internet IP.
Cancel
Vote Up 0 Vote Down

Cancel
0 marcB72 over 9 years ago

As a workaround I set the SipSupport from 'Strict' to 'Client/Server Network'.
After that, everything is working without additional FW-Rules or NAT-Rules.

But that is not that behaviour as it should be:
T-Online and Sipgate both have only one IP for SIP-Traffic(registration/Invitation/Sessiondescription...) but using different server for the RTP. In mode 'Strict' any RTP Ports should be opended dynamically according to Sessiondescriptions sent between addresses used for Registration.
any other traffic should be blocked.

The mode 'Client/Server Networks' is less restrivtive but not the mode normally should be used in most cases...

Hope there will be a fix in the SIP-Helpers soon!
CU
Marc
Cancel
Vote Up 0 Vote Down

Cancel
0 mle over 9 years ago

Hi,

I haven't verified your issue yet, but I have just reported it to our development bug tracker as Mantis #32548. If you happen to open a support case, please make sure to mention it for the Sophos support to know.

Best regards,
mlenk
Cancel
Vote Up 0 Vote Down

Cancel