403 Messages

[steveycarr]

Guys,

I'm having intermittent 403 messages in Sip Trace and access denied messages on telephone handset. Mivoice 7.1 to BT Sip trunks, (Hipcom). Link has registered ok, I can make several calls to same number then I can get 3 or 4 access denied messages, then the calls are successful again for a number of calls, looking at the Sip trace these are showing 403 messages. Cant be Cos or Cor as most times I can dial out? Any ideas would be much appreciated.

Steve

!ExtraDunce

 

[wireman50]

Nat keepalive not set so reregistration is required?

 

[steveycarr]

Hi,

Thanks for your reply, nat keepalive is set to 'no' i've always set it to 'no' as per BT's Sip Trunking guidelines, i've not had this before, do you think that the customers firewall could cause the issue, I tested my config in my workshop before installation and it worked fine.

cheers



!ExtraDunce

 

[wireman50]

I thought Hipcom natkeepalive was set to yes. i'm fairly sure mine was (4.2 on hipcom sip trunks) but its not in service anymore so i can't check. Check the latest SIP CoE on mitel for the hipcom settings or ask Hipcom for the conformity guide for SIP for Mitel.

The only issues I have had with firewalls has been one way xm. Except a MBG which wouldn't let me talk at all but everything connected on the teleworker. turned out to be setting on the sonic wall (TCP cheksum Error) which I got to with a wireshark trace...which would be my next suggestion for this issue. Do a wireshark trace on a failed call and see what it actually says on the failure.

 

[steveycarr]

Hi,

I tried setting nat keep alive to yes, and it dosent make any differnce, I've done a TCPDUMP and the Woireshark trace shows I'm getting a 403 form the SIP Platform, there's nothing else in the message other than 403 forbidden, I get 4 or 5 403's then next time the call goes through OK. I'm hoping HIPCOM can have a look and see why their rejecting the calls. I've attached the file for perusal.

Cheers



!ExtraDunce

 

[wireman50]

You have got the number of circuits that are provisioned to match the number of circuits in the SIP peer profile? ie you have say 4 sip trunks but have 6 in the sip peer profile? just a thought.

 

[steveycarr]

Wireman,

Ive got 10 trunks, hopefully thats matched on the platform,I need to check thats the case with Hipcom. Ive noticed after I get a 403, which tend to come in bursts of 3 or 4 then a register which comes back with a 401 unauthorised followed by a 200 ok message then I can make as many as 20 calls, maybe more, then a few more 403's before the 2 register requests then the calls flow again. Its like the link goes inactive then kicks back into life, although the maintenance logs dont show any activity.

Steve

!ExtraDunce

 

[wireman50]

Loks like it is a link problem then. Check your SIP peer profile carefully as its usually a problem in there somewhere. Is it a time out issue; does it do it on a time basis as the link refresh is set at 3600 seconds normally (IIRC) which is about an hour...does that correlate? Other than that look at the link itsef and see if its that that is a bit dodgy Is it BB or a PW?

 

[steveycarr]

Wireman,

all sorted SIP ALG was enabled on the Customers Firewall causing the ports to swap to random ports instead og 5060. Thanks for your help though.

Steve

!ExtraDunce